CVE Vulnerability Catalog

OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-account IAM role Impersonation in the AWS auth method. The vulnerability allows an IAM role from an untrusted AWS account to authenticate by impersonating a role with the same name in a trusted account, leading to unauthorized access. This impacts all users of the auth-aws plugin who operate in a multi-account AWS environment where IAM role names may not be unique across accounts. This vulnerability has been patched in version 0.1.1 of the auth-aws plugin. A workaround for this issue involves guaranteeing that IAM role names are unique across all AWS accounts that could potentially interact with your OpenBao environment, and to audit for any duplicate IAM roles.

W podatności CVE-2025-61136 występuje luka w komponentach resetowania hasła w axewater sharewarez v2.4.3, która pozwala zdalnym atakującym na przeprowadzenie ataku typu password reset poisoning oraz przejęcie konta poprzez manipulację nagłówkiem Host. Problem występuje, gdy Flask generuje linki resetujące hasło bez ustalonej wartości SERVER_NAME.

W podatności CVE-2025-61132 występuje luka w komponentach resetowania hasła w levlaz braindump v0.4.14, która pozwala zdalnym atakującym na przeprowadzenie ataku typu password reset poisoning oraz przejęcie konta poprzez manipulację nagłówkiem Host. Problem występuje, gdy Flask generuje linki do resetowania haseł bez ustalonej wartości SERVER_NAME.

Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same local network might send a crafted request to /cgi-bin/action endpoint and render the device completely unresponsive.

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS because parameters in GET requests sent to the /cgi-bin/action endpoint are not properly sanitized, making it possible to target logged-in admin users. The vendor did not respond in any way; only version 1.1.0.18 was tested, other versions might be vulnerable as well.

The Beaver Builder Plugin (Starter Version) for WordPress is vulnerable to Stored Cross-Site Scripting via the 'auto_play' parameter in all versions up to and including 2.9.2.1 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.

Podatność CVE-2025-11023 dotyczy oprogramowania AcBakImzala w wersjach przed 5.1.4, gdzie występuje możliwość lokalnego włączenia pliku PHP z niezaufanego źródła. Problem ten wynika z niewłaściwego zarządzania nazwami plików w instrukcjach include/require.

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchat_handle_chat_request AJAX action.

An open redirection vulnerability exists in MOLGENIS EMX2 v11.14.0. An attacker can create a malicious URL using a manipulated redirection parameter, potentially leading users to phishing sites or other malicious destinations.

A Path Traversal vulnerability exists in TESI Gandia Integra Total version 4.4.2236.1. An authenticated attacker can download a ZIP file containing server files, including those in parent directories, by exploiting the "direstudio" parameter in comprimir.php.

Energy CRM v2025 by Status Tracker Ltd contains a Stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input by sending a POST request to '/crm/create_job_submit.php' using the 'JobCreatedBy' parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

A flaw was found in the asynchronous message queue handling of the libsoup library, used by GNOME and WebKit-based applications for HTTP/2 communications. When network operations are aborted at specific timing intervals, an internal message queue item may be freed twice due to missing state synchronization, leading to a use-after-free memory access. Attackers can remotely trigger this by sending specific HTTP/2 read and cancel sequences, causing a denial-of-service condition.

Podatność CVE-2025-10914 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie OBS (System Informacji o Sprawach Studenckich) firmy Proliz Software Ltd. Co. Umożliwia to ataki typu Reflected XSS.

W podatności CVE-2025-10727 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w oprogramowaniu AcBakImzala firmy ArkSigner Software and Hardware Inc., co pozwala na ataki typu Reflected XSS. Problem dotyczy wersji AcBakImzala przed 5.1.4.

Slack Nebula before 1.9.7 mishandles CIDR in some configurations, thus accepting arbitrary source IP addresses within the Nebula network. This may allow unauthorized network access.

Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use, allowing them to deploy a compromised or counterfeit device on that site. This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.