CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. The flaw exists in Admin/user_record.php due to improper validation of the name/email arguments, allowing injection of malicious code. The exploit has been publicly disclosed and can be launched remotely.

A cross-site scripting (XSS) vulnerability has been identified in SourceCodester Drug Recommendation System 1.0. The flaw exists in Auth/add_student.php due to improper validation of the txtname/txtpassword/txtemail/txtphone/txtprevious_school arguments, allowing injection of malicious code. The exploit has been made publicly available and could be used for attacks remotely.

The AsyncHttpClient (AHC) library from version 2.1.0 until 3.0.14 does not retain whether a Set-Cookie response used a secure transport. The default ThreadSafeCookieStore accepts Secure cookies received over plaintext and permits insecure cookies to overlay or delete existing Secure cookies with matching scope. An attacker controlling a plaintext same-site response can plant, replace, or remove cookie state later sent to an HTTPS origin.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions. The vulnerability can lead to service unavailability.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. The flaw allows an attacker to gain elevated privileges on the system.

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (including DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.

A vulnerability in Temporal Server allows a connected peer cluster to modify local namespaces in the receiving cluster, which should not be replicated. The receiving cluster does not check if the namespace is global and overwrites its state, description, owner, retention, archival settings, cluster list, and active cluster if the task carries a higher failover version. An attacker controlling a registered peer's replies can change any local namespace without credentials on the receiving cluster, e.g., marking it Deprecated, causing new Workflow starts to fail.

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission.

A path traversal vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. Gleam reads the app field from the Hex package release metadata and uses it as the build directory name without validation; when a dependency fails to compile, Gleam deletes that directory with remove_dir_all. This issue affects gleam from 0.32.4 before 1.19.2.

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled, a restricted authenticated user can obtain sibling-path results that pass the prefix check.

In obsidian-tc prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JWT has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools.

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during enumeration. An authenticated caller can directly read sensitive files such as .obsidian/plugins/*/data.json.

A vulnerability in obsidian-tc, a Model Context Protocol server for Obsidian vaults, before version 1.3.1, does not validate Host or Origin headers or enable DNS-rebinding protection in the Streamable HTTP transport. With loopback configuration using auth.mode set to none, a malicious web page can send requests to the local MCP endpoint and gain unrestricted vault access via the http-local caller. Version 1.3.1 fixes the issue by enabling host, origin, and DNS-rebinding validation.

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware. A crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

The WordPress WP-Members plugin in versions up to 3.5.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The vulnerability may enable unauthorized users to access functions or data they should not have access to.

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager allows Leveraging Race Conditions. This issue affects Events Manager: from n/a through 7.4.7.

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to -32768. Binding parameter 32769 then writes about 2.5 MB of zeros starting 1.25 MB before the binding array, which crashes the application or leaves it running on a corrupted heap. Applications that build parameter lists from untrusted input, such as an IN (?, ?, ...) list, are exposed. Versions before psqlODBC 18.00.0005 are affected.

This CVE ID has been rejected and should not be used. It was issued in error, and all references and descriptions have been removed to prevent accidental usage.

A vulnerability was identified in Edimax BR-6208AC 1.32 in an unknown function of the file /goform/formWlanMP. Manipulation of the readE2P argument leads to command injection. The attack can be initiated remotely, and the exploit is publicly available and may be used.

A vulnerability was determined in Edimax BR-6208AC 1.32 affecting some unknown processing of the file /goform/formAutoFWupgrade. Manipulation of the tftpsIP argument can lead to command injection. The attack may be performed remotely, and the exploit has been publicly disclosed and may be utilized.