CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Bagecms v3.1.0 has a stored XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Settings module.

A XSS vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web scripts or HTML via the File Upload function.

Novu has an open redirect vulnerability in the 'Sign In with GitHub' functionality in versions prior to 0.16.0. An attacker could force a victim to open a malicious URL, potentially logging into the repository under the victim's account.

TravianZ through version 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks, allowing ordinary users to execute operations reserved for space or project administrators.

Vulnerability in the hang detector module related to kernel raw address leakage. Successful exploitation of this vulnerability may affect service confidentiality.

Vulnerability related to incomplete verification of apps' permissions to access a certain API in the wireless projection module. Successful exploitation of this vulnerability may affect some wireless projection features.

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository fossbilling/fossbilling prior to version 0.5.4.

In the GitHub repository it-novum/openitcockpit prior to version 4.6.6, there is a vulnerability related to sensitive cookies in HTTPS sessions that lack the 'Secure' attribute.

Statamic is a flat-first content management system powered by Laravel and Git. In versions prior to 4.10.0, the SVG tag does not sanitize malicious SVG, allowing attackers to perform cross-site scripting attacks using SVG, even when using the `sanitize` function. Version 4.10.0 contains a patch for this issue.

Uptime Kuma, a monitoring tool, has a path traversal vulnerability in versions prior to 1.22.1. This allows authenticated users to delete files from the server, potentially leading to data loss and system unavailability.

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker could craft malicious payloads to achieve command injection when entering the container terminal.

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.

Pandoc, a Haskell library for converting markup formats, has an arbitrary file write vulnerability that can be triggered by a specially crafted image element in the input. This affects versions from 1.13 to 3.1.4 when generating files using the `--extract-media` option or outputting to PDF format.

Taocms versions up to 3.0.2 are vulnerable to Cross Site Scripting (XSS), allowing attackers to inject malicious code into the application.

MechanicalSoup is a Python library for automating interaction with websites. In versions from 0.2.0 to prior to 1.3.0, a malicious web server can read arbitrary files on the client using an `<input type="file" ...>` inside an HTML form.

GLPI is a free asset and IT management software package. In versions from 9.4.0 to prior to 10.0.8, a malicious link can be crafted by an unauthenticated user, leading to a reflected XSS vulnerability if any authenticated user opens the crafted link.

GLPI is a free asset and IT management software package. Versions from 9.2.0 to prior to 10.0.8 have an incorrect rights check on a file accessible by an authenticated user, allowing access to view all KnowbaseItems.

AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.