CVE Vulnerability Catalog

The User Registration plugin (ThemeGrill) through version 5.3.0 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The Multiple Pages Generator plugin (Themeisle) before version 4.2.5 contains a stored XSS vulnerability that allows Contributor-level users to inject script via the base-url attribute of the [mpg] and [mpg_match] shortcodes. Malicious payloads pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}.

lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

The flat library through version 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Keys such as a.4294967294 can block the Node.js event loop during iteration with forEach, spread, or JSON.stringify.

JeeSite versions 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. An attacker knowing a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.

The JetSmartFilters plugin for WordPress (Crocoblock) through version 3.8.6.2 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the site can execute in other users' browsers.

The SureForms plugin (Brainstorm Force) through version 2.12.9 does not properly neutralize script-related HTML tags, allowing Basic XSS and code injection. The issue affects versions from n/a through 2.12.9.

A reflected cross-site scripting vulnerability exists in the agent query feature of BMC Helix Operations Management 25.4.00. An authenticated attacker can execute script in another user's browser after that user opens a crafted link.

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

In dnsmasq, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format after internal buffer sizes were reduced. An attacker able to force validation of a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

In dnsmasq, when following a CNAME in a DNS response, the resolver can cache records for the CNAME target without verifying they belong to the responding server's authorized zone. In split-DNS deployments sending some domains to a specific upstream, an attacker controlling that upstream can inject cache entries for unrelated names.

The TCP DNS service in dnsmasq uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation requiring TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

The TFTP server in dnsmasq can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network able to request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

The Post Grid plugin for WordPress by Mamunur Rashid contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 7.9.7.