CVE Vulnerability Catalog

WeGIA prior to version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter taken from the GET request is not validated or whitelisted, then used directly in a Location header. An attacker can redirect users to a malicious site.

WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.

Code Extension Marketplace prior to version 2.4.2 has a Zip Slip vulnerability allowing a malicious VSIX file to write arbitrary files outside the extension directory.

In WWBN AVideo versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Other endpoints in the CloneSite directory require admin privileges. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

In WWBN AVideo versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. Other FFmpeg management endpoints require admin privileges.

In WWBN AVideo versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

Directus before version 11.17.0 does not deduplicate resolver invocations in GraphQL queries. An authenticated user can exploit GraphQL aliasing to repeat expensive relational queries many times, causing database overload and server resource exhaustion.

In Directus before version 11.16.1, despite disabling GraphQL introspection (GRAPHQL_INTROSPECTION=false), the server_specs_graphql resolver on the /graphql/system endpoint still returned the schema in SDL format. This allowed bypassing the introspection control and exposing database structure (collection names, field names, types, and relationships) to unauthenticated users at the public level and to authenticated users at their permission level.

Directus prior to version 11.16.1 is vulnerable to an open redirect via the 'redirect' parameter on the /admin/tfa-setup page. An administrator who has not configured 2FA yet, after visiting a crafted URL and completing the 2FA setup, is redirected to an attacker-controlled external domain without any validation.

Directus prior to version 11.16.1 contains an open redirect vulnerability in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication.

The Open edX Platform before commit 76462f1e5fa9b37d2621ad7ad19514b403908970 contains an open redirect vulnerability in the view_survey endpoint. The redirect_url parameter is not validated, allowing attackers to redirect authenticated users to malicious sites and perform phishing and credential theft.

OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability. Unauthenticated attackers can submit malicious User-Agent headers to the /ocsinventory endpoint, which are stored without sanitization and rendered in the web console, leading to arbitrary JavaScript execution in authenticated users' browsers.

Tenda CX12L router version 16.03.53.12 has a stack-based buffer overflow in the fromP2pListFilter function in /goform/P2pListFilter. An attacker from the local network can manipulate the page argument to trigger the overflow.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The parameter is not validated, allowing redirection to arbitrary external websites.

WeGIA before 3.6.9 has a stored XSS vulnerability via a backup filename. An attacker can inject malicious scripts that execute in the victim's browser.

WeGIA prior to 3.6.9 has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter. The application fails to validate the parameter, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The parameter is not validated, allowing redirection to arbitrary external websites.

Bulwark Webmail prior to version 1.4.11 sets the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means XSS attacks are logged but not blocked, allowing arbitrary JavaScript execution via crafted email HTML.

Lichess.org before commit 0d5002696ae705e1888bf77de107c73de57bb1b3 contains a server-side HTML injection vulnerability. Approved streamers can inject arbitrary HTML into their Twitch/YouTube stream title, which is rendered on the streamer page and the 'Live streams' widget on the homepage.