CVE Vulnerability Catalog

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default.

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS. This issue affects Brizy: 2.8.23.

A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.

An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.

Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application's responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes.

A Stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts version 2025.61 due to insufficient validation or sanitisation of user input in the 'city' and 'province' fields in the 'ListAlmacen' endpoint. Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser or escalate privileges from a normal user to an administrator.

A DOM-based Cross-Site Scripting attack is possible against Stormshield's web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of an out-of-bounds read.

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This allows an attacker to repeatedly attempt password guesses for a user account without adequate restrictions.

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the update_license AJAX action in all versions up to and including 5.2.0 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages.

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server.

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory.

A DOM-based cross-site scripting (XSS) vulnerability in LIFF SDK versions 2.20.0 through 2.31.0 allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of authentication tokens or application data, or unauthorized actions using the user's session.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme, producing a stored or reflected cross-site scripting vector. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten. This can bypass host-based policies such as denylists, loopback filtering, redirect validation, or outbound proxy routing. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3.

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.