CVE Vulnerability Catalog

A cross site scripting vulnerability has been detected in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/expense_categories/create on the Expense Categories Page is affected. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross site scripting weakness has been identified in projectworlds Expense Management System 1.0. An unknown function of the file /public/admin/currencies/create on the Currency Page is impacted. The attack can be initiated remotely and the exploit has been made publicly available.

A cross site scripting security flaw has been discovered in projectworlds Expense Management System 1.0. It affects an unknown function of the file /public/admin/roles/create on the Roles Page. The attack can be performed remotely and the exploit has been released to the public.

A cross site scripting vulnerability was identified in projectworlds Expense Management System 1.0. The impacted element is an unknown function of the file /public/admin/users/create on the Users Page. The attack can be carried out remotely and the exploit is publicly available.

A cross site scripting vulnerability was determined in projectworlds Gate Pass Management System 1.0. The affected element is an unknown function of the file /add-pass.php. The attack can be executed remotely and the exploit has been publicly disclosed.

A flaw has been found in Iqbolshoh php-business-website up to commit 10677743a8dfc281f85291a27cf63a0bce043c24. The vulnerability affects unknown code in admin/contact.php. Manipulation of the argument twitter causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The product uses a rolling release model, so specific version information is not available. The vendor was contacted but did not respond.

In Kamailio 5.5, the yyerror_at function in src/core/cfg.y (grammar rule handler) causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is questioned, and the vendor did not respond.

A flaw in Kamailio 5.5 in the rve_is_constant function of src/core/rvalue.c causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is still questioned, and the vendor did not respond to the disclosure.

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1. Under certain conditions, authenticated users could gain unauthorized project access by exploiting the access request approval workflow.

GitLab EE versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 contained an issue that could allow an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions. The issue has been remediated.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress up to version 4.8.4 is vulnerable to unauthorized data modification due to insufficient capability checks in the post_deactive() and post_activate() functions. This allows authenticated attackers with Editor-level access or above to activate and deactivate licenses.

The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to and including 2.7.11. This is due to trusting client-controlled HTTP headers in the pp_get_ip_address() function when the "Use transients" feature is enabled. Attackers can bypass authorization by spoofing these headers with the IP of an authenticated user.

Wasmtime, a runtime for WebAssembly, contains a vulnerability in versions from 38.0.0 to before 38.0.3. A bug in the implementation of component-model related host-to-wasm trampolines allows carefully crafting a component that, when called in a specific way, would crash the host with a segfault or assert failure. Wasmtime 38.0.3 has been released and is patched. There are no workarounds.

The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to functions, allowing any admins to perform LFI attacks.

Cross-Site Scripting (XSS) vulnerability in the CookieConsent extension for MediaWiki by Wikimedia Foundation. Affects versions from v0.1.0 before v2.0.0. The issue is due to improper neutralization of input during web page generation.

A high-privileged remote attacker can influence parameters passed to the openssl command due to improper neutralization of special elements when adding a password-protected self-signed certificate.

On Mercku M6a devices through version 2.1.0, the authentication system uses predictable session tokens based on timestamps.

Mercku M6a devices through version 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.

On Mercku M6a devices through version 2.1.0, session tokens remain valid for at least months in some cases.

Vulnerability in the Oracle ZFS Storage Appliance Kit product (component: Naming Subsystem). The supported version affected is 8.8. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit, resulting in unauthorized ability to cause a partial denial of service. CVSS 3.1 Base Score 2.7 (Availability impacts).