CVE Vulnerability Catalog

Dockyard before version 1.1.0 lacks CSRF protection for Docker container start and stop operations. An attacker can force a logged-in administrator's browser to send GET requests, allowing unauthorized container management.

In Junos OS on MX Series with MPC10, MPC11, LC4800, LC9600 line cards and MX304, firewall filters applied to loopback interface lo0.n (where n is non-zero) are not executed when lo0.n is in the global VRF/default routing-instance. This allows an unauthenticated network-based attacker to bypass the configured firewall filter and access the device's control-plane.

A vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high-privileged attacker to escalate privileges to root. The CLI accepts input without proper validation, enabling shell command injection executed with root permissions.

A Cross-site Scripting (XSS) vulnerability was found in Juniper Networks Junos Space in the list filter field. It allows an attacker to inject malicious script tags that, when visited by another user (including an administrator), execute commands with the target's permissions. All versions before 24.1R5 Patch V3 are affected.

A flaw was found in libcap. A local unprivileged user can exploit a TOCTOU race condition in the `cap_set_file()` function, allowing an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file.

A stored cross-site scripting (XSS) vulnerability exists in Kiamo before version 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

In awwaiid mcp-server-taskwarrior up to version 1.0.1, there is a command injection vulnerability in the server.setRequestHandler function of index.ts via the Identifier argument. Local access is required. An exploit is publicly available, and a patch exists.

The Download Manager plugin for WordPress up to version 3.3.52 is vulnerable to Stored XSS via the 'sid' attribute of the 'wpdm_members' shortcode. Insufficient input sanitization and output escaping allow attackers with contributor-level access to inject arbitrary scripts.

The OSM – OpenStreetMap plugin for WordPress up to version 6.1.15 is vulnerable to Stored Cross-Site Scripting via the 'marker_name' and 'file_color_list' shortcode attributes of the [osm_map_v3] shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when a user visits the page.

The Ziggeo plugin for WordPress up to version 3.1.1 lacks authorization in the wp_ajax_ziggeo_ajax handler. It only verifies a nonce, not user capabilities. The nonce is exposed to all logged-in users. Authenticated attackers (Subscriber+) can perform many admin operations like saving translations, managing event templates, modifying SDK settings, and managing notifications.

The Experto Dashboard for WooCommerce plugin for WordPress up to version 1.0.4 is vulnerable to Stored Cross-Site Scripting in settings fields (e.g., Navigation Font Size). Insufficient input sanitization and output escaping allow authenticated attackers with Administrator access to inject scripts that execute on the settings page. This only affects multi-site installations and installations where unfiltered_html is disabled.

The MStore API plugin for WordPress up to version 4.18.3 has an IDOR vulnerability in the update_user_profile() function. An authenticated user with Subscriber access can modify arbitrary meta fields on their account, including sensitive ones like wp_user_level, without proper validation.

In taskflow-ai up to version 2.1.8, an OS command injection vulnerability was found in the terminal_execute component via manipulation in src/mcp/server/handlers.ts. The attack is remotely exploitable. Version 2.1.9 fixes the issue.

code-projects Simple IT Discussion Forum 1.0 has a cross-site scripting vulnerability in /edit-category.php via the Category argument. The attack can be launched remotely. The exploit has been published and may be used.

code-projects Simple Laundry System 1.0 has a cross-site scripting vulnerability in /delmemberinfo.php via the userid argument. The attack can be initiated remotely. The exploit is public and may be used.

itsourcecode Construction Management System 1.0 has SQL Injection in /borrowed_tool_report.php via the Home argument. Remote attack possible, exploit public.

A business logic error has been discovered in SourceCodester Pharmacy Product Management System 1.0 in the file add-sales.php, within the POST Parameter Handler component. Manipulating the txtqty argument leads to business logic errors. The attack can be performed remotely and the exploit has been publicly released.

A vulnerability exists in SourceCodester Online Food Ordering System 1.0 in the save_product function of /Actions.php in the POST Parameter Handler component. Manipulation of the price argument leads to business logic errors. The attack may be performed remotely. The exploit is publicly available and might be used.

GitLab EE versions 18.2 to 18.8.9, 18.9 to 18.9.5, and 18.10 to 18.10.3 have a vulnerability in customizable analytics dashboards allowing an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

Sonatype Nexus Repository versions 3.0.0 through 3.90.2 contain a reflected cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.