CVE Vulnerability Catalog

A vulnerability in Easy!Appointments before version 1.6.0 allows an authenticated provider to inject appointments into another provider's schedule. The `appointments/store` and `appointments/update` endpoints do not verify that the provider ID belongs to the current session, breaking provider isolation. Additionally, the `store` path has a write-before-crash bug that persists unauthorized data in the database.

A stored XSS vulnerability in Easy!Appointments allows an administrator to inject malicious HTML/JavaScript into the booking disabled message field. This content is displayed unsanitized on the public booking page, affecting every unauthenticated visitor.

An HTTP Response Splitting vulnerability in FortiOS and FortiProxy allows an attacker to inject arbitrary HTTP headers via crafted captive portal authentication requests. Affected versions include FortiOS 7.6.0-7.6.4, 7.4.x, 7.2.x and FortiProxy 7.6.0-7.6.4, 7.4.x, 7.2.x.

An HTTP Response Splitting vulnerability in FortiOS and FortiProxy allows an attacker with a valid web filter override token to inject arbitrary HTTP headers by tricking a user into clicking a crafted link.

A vulnerability was found in open62541 up to version 1.5.5, affecting the function responseReadNamespacesArray in src/client/ua_client_connect.c. Manipulation of the Server_NamespaceArray argument causes a null pointer dereference, potentially leading to application crashes. The attack can be executed remotely but requires high complexity and is difficult to exploit.

A classic buffer overflow vulnerability was found in the SUSE Virtual Machine Driver Pack due to copying data without checking input size. An attacker with registry modification capabilities could affect driver integrity. No feasible exploitation method is currently known.

A security vulnerability has been detected in code-projects Online Job Portal 1.0. An unknown function in the file /Admin/DetailJob.php leads to cross-site scripting (XSS). The attack can be carried out remotely, and the exploit has been publicly disclosed.

A vulnerability in SAP HANA Database (user self service tools) allows an unauthenticated attacker to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could lead to account enumeration, resulting in low impact on confidentiality, with no impact on integrity and availability.

A security vulnerability has been detected in wandb version 0.25.2.dev1 in the ArtifactManifestEntry.download function within hashutil.py. It involves the use of a weak hash function during artifact integrity validation. The attack can be initiated remotely but requires a high degree of complexity.

A vulnerability was found in waooAI waoowaoo up to version 0.4.1 in the stablePublicIdFromStorageKey function of the Media Handler component. Manipulation of the storageKey argument leads to improper authorization, enabling a remote attack with high complexity. The exploit is public and the project has not responded.

A vulnerability in Mattermost allows a user with the User Manager role to obtain invite links for private teams via the scheme teams endpoint. Lack of proper sanitization of team objects enables joining or sharing access to those teams.

The User Profile Picture WordPress plugin (versions up to 2.6.3) contains an authorization bypass vulnerability through a user-controlled key. This allows an attacker to exploit incorrectly configured access control security levels.

A cross-site scripting vulnerability was found in SourceCodester Online Book Store System 1.0 in the User Management Module. Manipulation of the Name or Username arguments allows remote script execution. The exploit is publicly available.

A vulnerability was found in kicad-mcp up to version 3.3.1 in the file kicad_mcp/utils/path_validator.py. Manipulation of the project_path or schematic_path arguments leads to protection mechanism failure. Local access is required and the exploit has been made public.

A path traversal vulnerability has been found in the augmnt augments-mcp-server version 7.1.0 in the scanProjectDeps function of the file src/tools/v4/scan-project-deps.ts. The attack requires local access and manipulation of the packageJsonPath argument. The exploit has been published and the project has not responded to the report.

A security vulnerability in alioshr memory-bank-mcp up to version 0.2.1/3.1 allows path traversal via the projectName argument in list-project-files-validation-factory.ts. Local access is required, and the exploit has been publicly disclosed.

A cross-site scripting vulnerability has been found in vnotex vnote up to version 3.20.1 in the YAML Frontmatter processing function within markdownit.js. Manipulation of the p_metaData argument allows remote script execution in the victim's browser.

In the Nuvoton NuMaker HSUSBD USB device-controller driver (udc_numaker.c), the control Data IN stage is unconditionally armed. When a USB host cancels an in-flight control transfer (timeout) and issues a new SETUP packet, the driver becomes out of sync, potentially sending stale data and permanently NAK'ing the control endpoint.

A vulnerability in FileBrowser before version 2.63.17 fails to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.

Capgo before version 12.128.2 contains a SQL injection vulnerability in the POST /private/admin_stats endpoint. The limit parameter is destructured from an unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals.