CVE Vulnerability Catalog

Notepad++ w wersji 8.8.3 posiada podatność na przechwytywanie DLL, co umożliwia zastąpienie oryginalnego pliku DLL w celu wykonania złośliwego kodu. Należy zauważyć, że to zachowanie jest kwestionowane przez wiele stron, ponieważ występuje tylko wtedy, gdy użytkownik zainstaluje produkt w katalogu, który pozwala na zapis przez nieuprzywilejowanych użytkowników.

A vulnerability was found in Dibo Data Decision Making System up to version 2.7.0. It affects the downloadImpTemplet function in the file /common/dep/common_dep.action.jsp. Manipulation of the filePath argument leads to path traversal. The attack can be launched remotely, and the exploit has been made public.

W systemie CourseSelectionSystem firmy kidaze do wersji 42cd892b40a18d50bd4ed1905fa89f939173a464 zidentyfikowano podatność. Manipulacja argumentem cbe prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie CourseSelectionSystem kidaze do wersji 42cd892b40a18d50bd4ed1905fa89f939173a464 znaleziono lukę. Problem dotyczy nieznanego przetwarzania pliku /Profilers/PriProfile/COUNT3s6.php, co może prowadzić do wstrzykiwania SQL poprzez manipulację argumentem CPU.

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later.

W oprogramowaniu układowym DIR-823 w wersji 20250416 odkryto problem związany z zdalnym wykonaniem kodu (RCE) w interfejsie ustawień set_cassword. Parametr http_casswd nie jest filtrowany przez '&', co umożliwia wstrzykiwanie poleceń do nawiązania odwrotnego połączenia.

W systemie zarządzania pracownikami Tutorials-Website wykryto podatność, która dotyczy nieznanej funkcji w pliku /admin/all-applied-leave.php komponentu HTTP Request Handler. Manipulacja prowadzi do niewłaściwej autoryzacji, a atak może być przeprowadzony zdalnie.

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

Flag Forge CTF platform versions 2.0.0 to before 2.3.2 expose user email addresses in the JSON response of the public endpoint /api/user/[username]. The fix, available from 2.3.2, removes emails from public API responses. No workarounds exist.

A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the Image Handler component. Manipulation results in information disclosure. Remote exploitation is possible and the exploit has been released publicly.

A vulnerability was identified in Vvveb (up to version 1.0.7.2) in an unknown function of the SVG file handler component. The cross-site scripting (XSS) flaw can be exploited remotely. The exploit is publicly available and might be used.

Podatność CVE-2025-6396 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Webbeyaz Website Design, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy oprogramowania do projektowania stron internetowych do 14 lipca 2025 roku.

A vulnerability in givanz Vvveb up to 1.0.7.2 affects an unknown functionality of the Configuration File Handler component. Manipulation leads to information disclosure. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability has been found in Total.js CMS (up to version 19.9.0) in an unknown function of the files menu component. The manipulation leads to cross-site scripting (XSS). The attack can be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability in Four-Faith Water Conservancy Informatization Platform 1.0 affects an unknown function in /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Manipulation of the fileName argument leads to path traversal. The attack can be launched remotely and the exploit is public.

In Ogre library up to 14.4.1, the Ogre::LogManager::stream function in OgreLogManager.cpp allows manipulation of the mDefaultLog argument, resulting in a null pointer dereference. The attack requires local access, and the exploit is publicly available.

kalcaddle kodbox up to version 1.61.09 has a path traversal vulnerability in the fileOut function in app/controller/explorer/index.class.php. Manipulation of the path argument allows remote attack. The exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.

A weakness has been identified in Ogre up to version 14.4.1 in the STBIImageCodec::encode function of /ogre/PlugIns/STBICodec/src/OgreSTBICodec.cpp. Manipulation causes mismatched memory management routines. The attack requires local execution and the exploit is publicly available.

In Seagate Toolkit on Windows a vulnerability exists in the Toolkit Installer prior to versions 2.35.0.6 where it attempts to load DLLs from the current working directory without validating their origin or integrity. This behavior can be exploited by placing a malicious DLL in the same directory as the installer executable, leading to arbitrary code execution with the privileges of the user running the installer. The issue stems from the use of insecure DLL loading practices, such as relying on relative paths or failing to specify fully qualified paths when invoking system libraries.

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.