CVE Vulnerability Catalog

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted but did not respond.

A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the Certificate Path Builder component. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted but did not respond.

A vulnerability in APOGEE MBC, APOGEE MEC, APOGEE PXC Compact, APOGEE PXC Modular, TALON TC Compact, and TALON TC Modular is due to lack of validation of user-supplied input in upload code in the web service. An unauthenticated remote attacker can cause a denial of service.

A vulnerability in the web service of APOGEE and TALON products. Improper validation of user input in multipart handling could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in the FTP service of APOGEE and TALON products. Improper validation of input length could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in the web service of APOGEE and TALON products. Improper validation of input length could allow an unauthenticated remote attacker to read portions of device memory or cause a denial-of-service condition.

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file is served by the CDN with Content-Type: image/svg+xml and, when navigating directly to that URL, the script executes within the context of the CDN's domain.

The authorization middleware of the WMS MobileServer fails to require authentication in two cases: it only requires an Authorization header for GET and HEAD requests, and requests with a malformed or non-bearer Authorization header are passed through without a valid token being required. A remote attacker with network access can invoke API functionality without valid credentials.

Client-Side Enforcement of Server-Side Security vulnerability in Biletiva Ticketing Platform by Divasoft. Allows manipulating state.

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects User Registration: from n/a through 5.2.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS. This issue affects SureCart: from n/a through 4.9.4.

Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FluentBoards: from n/a through 2.1.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS. This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1.

Blind SQL Injection vulnerability in Link Whisper Free plugin. Improper neutralization of special elements in SQL command allows blind SQL injection.

Missing Authorization vulnerability in TMS Amelia ameliabooking allows exploiting incorrectly configured access control security levels. This issue affects Amelia from n/a through 2.4.10.

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete. Manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability in AdithyaYelloju Restaurant-Management-System. The mysqli_query function in Order Management component allows authorization bypass via manipulation of the ID argument.

SQL Injection vulnerability in User/forgot3.php of Password Reset component in Restaurant-Management-System. Manipulation of email/password arguments results in SQL injection.

A vulnerability in User/login.php of Login Form component in Restaurant-Management-System. Manipulation of email/passwd arguments leads to improper authentication.

The Wavlink WL-WN592AX6 router version 250422 contains a vulnerability in the system function of the wmapd daemon component. Manipulation of an argument leads to OS command injection, and the attack can be launched remotely.