CVE Vulnerability Catalog

MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-escaped but not sanitized for the JavaScript string context, meaning a malicious linked server could supply a tag ID containing characters (such as a single quote) that break out of the JavaScript string literal and inject arbitrary script. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the linked server supplies a crafted tag ID in an event, and an authenticated user views the event preview and interacts with the affected tag element. Impact: arbitrary JavaScript execution in the context of the viewing user's browser session, potentially allowing session hijacking, data exfiltration, or unauthorized actions on behalf of the user. Affected versions: MISP prior to the fix commit (v2.5.48 or later, exact boundary unconfirmed).

MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control or influence the content of a TAXII object can inject arbitrary HTML or JavaScript that executes in the context of the victim's MISP session. Preconditions: the victim must be an authenticated MISP user with access to the TAXII object viewer, and the victim must open or view the crafted TAXII object. Impact: execution of arbitrary JavaScript in the victim's browser within the MISP application context, potential theft of session tokens, API keys, or other sensitive data, and potential for performing actions on behalf of the authenticated user. Affected versions: <2.5.48.

MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without proper output encoding. A malicious or compromised linked server could return a crafted event ID containing arbitrary HTML or JavaScript markup. This markup would be rendered in the browser of any user in the host organization who views the ID Translator page, enabling session hijacking, credential theft, or other client-side attacks. Preconditions: the victim must be an authenticated user of the host MISP instance, a linked server must be configured on the host instance, and the victim must navigate to the ID Translator page for a given event. Affected versions: <2.5.48.

MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: a linked/remote MISP server is configured and connected to the local instance, the attacker has sufficient access on the linked server to create or modify an event with a crafted identifier, and a victim user on the local instance views the remote event preview index page. Impact: execution of arbitrary JavaScript in the context of the MISP web application, potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48.

PostCSS Selector Parser before version 7.1.6 has a performance issue — parsing a malicious CSS selector can be quadratic, allowing a parser thread to be blocked. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected.

uv (Python package and project manager) from version 0.12.7 to 0.12.18 has a vulnerability on Windows that allows writing a file outside the installation prefix during extraction of a malicious wheel. This can place an executable in a directory on the user's PATH.

Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

TurkHotspot by MRV Technology Foreign Trade Ltd. Co. contains a Reflected XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions through 2026-10-02. The vendor was contacted but the product is not supported.

Missing authorization vulnerability in the LearnPress WordPress plugin, allowing exploitation of incorrectly configured access control security levels.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing. This issue affects Aculect AI Companion: from n/a through 0.8.2.

PublishPress Series (WordPress plugin) through version 3.1.3 has an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.

WebSamurai (WordPress plugin) through version 1.0.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Airano MCP Bridge (WordPress plugin) through version 2.11.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Smart One Click Setup – Complete Demo Import & Export (WordPress plugin) through version 1.4.3 has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.

onetwothreeneth HospitalManagementSystem (up to 9ef91ed6007314b6473110ed699dff76d158f61d) has a vulnerability in php/sessions.php where manipulation of the ID argument leads to improper authentication. Remote exploitation is possible and the exploit has been publicly disclosed.

A SQL injection vulnerability was discovered in CodeAstro Simple Loan Management System 1.0 in the file /admin/index.php, affecting the g_name argument. The attack can be performed remotely, and the exploit is publicly available.

A path-traversal vulnerability in the logback-classic module (Java) allows writing log files outside the intended directory when an MDC-based discriminator value (e.g., from an HTTP header) flows unsanitized into a nested FileAppender path. Affects versions from 0.9.14 through 1.6.4.

A SQL injection vulnerability was discovered in CodeAstro Simple Pharmacy Management System 1.0 in the file /SimplePharmacy-PHP/product/delete.php, affecting the ID argument. The attack can be performed remotely, and the exploit is publicly available.