CVE Vulnerability Catalog

MCP Context Forge versions 0.2.0 through 0.3.1 store a prompt template without sufficient output encoding before rendering in the MCP Admin UI. An authenticated attacker can save markup with script-capable event handlers that execute when another user views the saved prompt. This enables stored XSS, interface alteration, phishing, keystroke observation, and actions in the victim's browser session.

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption.

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct an escalation of privilege via network access.

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

InstallShield version 2025 R2 and earlier has a potential privilege escalation issue when running a compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers may also load from an unsecured location, potentially leading to privilege escalation.

HyperScale contained a path traversal issue affecting information disclosure. The vendor recommends upgrading to the resolved maintenance release.

A denial-of-service security issue exists in the affected product and version. The issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.

A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability applies only when the Block Sites feature is turned on.

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device's management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions.

Listed NETGEAR Extender models have insufficient session randomness. A network-adjacent attacker with network access (such as WiFi credentials) can predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

A SQL injection vulnerability was found in girishsaraf Online-Appointment-Booking-System in the file Admin/getclinic.php of the AJAX Endpoint component. Manipulation of the city/cid argument allows remote exploitation, and the exploit has been made public. The project uses a rolling release model, so version information is unavailable, and the issue report has not been responded to.

A SQL injection vulnerability was found in girishsaraf Online-Appointment-Booking-System in the file Admin/deleteclinic.php of the Admin CRUD Endpoint component. Manipulation of the cid/did argument allows remote exploitation, and the exploit has been disclosed to the public. The project follows a rolling release approach, so version details are not provided, and the issue report has not been responded to.

A SQL injection vulnerability was detected in girishsaraf Online-Appointment-Booking-System in the file changebookingstatus.php. Manipulation of the dateselected argument allows remote exploitation, and the exploit is now public. The product uses a rolling release model, so specific version information is not available, and the issue report has not been responded to.

Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.

Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.

NETGEAR R7300 router has insufficient input validation in the LAN Setup feature. An authenticated administrator connected to the local network can perform unauthorized actions on the router. This was identified in a controlled research environment using a simulated version of the router software and has not been confirmed on physical production devices.

An insufficient input validation vulnerability exists in the PPPoE Setup feature of the NETGEAR R7300 router, allowing authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.

Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. The converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again, allowing an attacker to bypass validation.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions.