CVE Vulnerability Catalog

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). The vulnerability is fixed in versions 5.15.19, 6.5.9, and 6.8.2.

The NS Maintenance Mode for WP WordPress plugin through version 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

The Umami Analytics module for Drupal before version 1.0.1 contains a Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

LiteLLM contains an information disclosure vulnerability in the health API related to the API_KEY parameter. An authenticated remote attacker could disclose sensitive information because the health endpoint improperly exposes data to unauthorized actors. This may lead to leakage of stored credentials and further compromise.

The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information.

The GitHub Workflow Updater VS Code extension before version 0.0.7 stored any provided GitHub token in plaintext in the editor configuration as JSON on disk, rather than using the more secure 'securestorage' API. An attacker with read-only access to the home directory could read this token and use it to perform actions.

A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.

A flaw has been found in SourceCodester Student Grades Management System 1.0 in the delete_user function of /admin.php. Manipulation leads to cross site scripting. The attack can be performed remotely and the exploit is publicly available.

A security flaw has been discovered in Willow CMS up to 1.4.0 in the file /admin/articles/add (Add Post Page component). Manipulation of the title/body arguments results in cross site scripting. The attack may be launched remotely and the exploit has been released.

A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0 in an unknown function of view-pass-detail.php. Manipulation of the Fullname/Category arguments causes cross site scripting. The attack may be initiated remotely and the exploit has been published.

A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0 in an unknown function of edit-category-detail.php. Manipulation of the catname argument results in cross site scripting. The attack can be launched remotely and the exploit is now public.

A vulnerability in PHPGurukul Curfew e-Pass Management System 1.0, affecting an unknown function in the file admin-profile.php. Manipulation of the adminname/email arguments leads to cross-site scripting (XSS). The attack may be launched remotely. The exploit has been published.

A vulnerability was identified in code-projects Client Details System 1.0 in an unknown function of /admin/manage-users.php. Manipulation leads to cross site scripting. The attack can be initiated remotely and the exploit is publicly available.

A cross site scripting vulnerability was determined in code-projects Client Details System 1.0. An unknown function of the file /admin/clientview.php is impacted. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross site scripting vulnerability was found in code-projects Client Details System 1.0. The issue affects some unknown processing of the file /update-clients.php. The attack can be initiated remotely and the exploit has been made public.

A vulnerability in code-projects Client Details System 1.0, affecting unknown code in the file /welcome.php. Such manipulation leads to cross-site scripting (XSS). The attack may be performed remotely. The exploit has been disclosed publicly.

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with access to the logs could potentially obtain the sensitive agent token.

A cross-site scripting (XSS) vulnerability was found in LearnHouse up to version 98dfad76aad70711a8113f6c1fdabfccf10509ca in the /dash/org/settings/previews file of the Account Setting Page component. Manipulation leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

In Wisencode up to version 20251012, an unknown function in /support-ticket/create of the Create Support Ticket Handler component allows cross-site scripting via manipulation of the Message argument. The attack can be launched remotely, and the vendor did not respond to the disclosure.

A cross-site scripting vulnerability was found in an unknown function of the Admin UI component in OpenWGA 7.11.12 Build 737. The attack can be initiated remotely and the exploit has been publicly disclosed.