CVE Vulnerability Catalog

The Codection Import and export users and customers plugin contains a Stored Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. The issue affects versions from the initial release through 2.5.9.

The Brave Popup Builder WordPress plugin (Brave) through version 0.8.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The PDF Poster WordPress plugin (pdf-poster) through version 2.6.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious script can be persistently stored and executed for users.

The HivePress Claim Listings plugin through version 1.1.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

The Kali Forms plugin through version 2.4.27 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

The User Registration plugin (ThemeGrill) through version 5.3.0 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The Multiple Pages Generator plugin (Themeisle) before version 4.2.5 contains a stored XSS vulnerability that allows Contributor-level users to inject script via the base-url attribute of the [mpg] and [mpg_match] shortcodes. Malicious payloads pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}.

lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

The flat library through version 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Keys such as a.4294967294 can block the Node.js event loop during iteration with forEach, spread, or JSON.stringify.

JeeSite versions 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. An attacker knowing a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.

The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.

The SureForms plugin (Brainstorm Force) through version 2.12.9 does not properly neutralize script-related HTML tags, allowing Basic XSS and code injection. The issue affects versions from n/a through 2.12.9.

A reflected cross-site scripting vulnerability exists in the agent query feature of BMC Helix Operations Management 25.4.00. An authenticated attacker can execute script in another user's browser after that user opens a crafted link.

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.