CVE Vulnerability Catalog

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_query POST parameter directly into an HTML input field VALUE attribute. Attackers can craft a malicious request containing a JavaScript payload in the frm_query parameter that executes in the victim's browser when submitted.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in routes_nm.php, where the ticket_id parameter is passed unsanitized into the VALUE attribute of a hidden input field. An authenticated attacker can inject JavaScript via a crafted URL.

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim's browser when the URL is visited.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_facnote.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in opena.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized frm_call GET parameter that is directly output on the page.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in patient_JF.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into a JavaScript variable assignment.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_note.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into an HTML attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single_unit.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized id GET parameter that is directly placed into an HTML attribute.

ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.

ArcGIS Server has an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker can send a crafted request to this endpoint, potentially disrupting the web-based browsing interface. This affects ArcGIS Server 12.0 and earlier.

CryptPad before 2026.2.0 has an HTML sanitizer bypass in Diffmarked.js. The sanitizer only validates the src attribute of <iframe>, <video>, and <audio> elements, leaving other attributes like srcdoc unchecked. An attacker can inject arbitrary HTML, defeating bounce sandboxing.

Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.

In Splunk Enterprise before versions 10.2.2, 10.0.5, 9.4.11, 9.3.12 and Splunk Cloud Platform before specified versions, a low-privileged user (without admin or power roles) can cause a denial of service (DoS) by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user without 'admin' or 'power' roles could access confidential data restricted by `srchFilter` configurations on custom roles. The app contains an `authorize.conf` file with a `srchFilter` entry that modifies the built-in 'user' role. Because Splunk combines inherited search filters with the `OR` SPL operator, the injected filter overrides more restrictive filters on child roles.

Prototype pollution in CSV parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior, enabling '1-click' command execution.

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

In Keycloak, the cross-session verification proof is keyed only by (localUserId, idpAlias) and is not bound to the upstream identity. A second upstream account on the same IdP can consume it and get linked to the victim's local account.

InfoScale VIOM version 9.1.3 contains an XSS vulnerability.