CVE Vulnerability Catalog

Podatność CVE-2025-13505 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych, co prowadzi do ataków typu Cross-site Scripting (XSS). Dotyczy to wersji Datactive od 2.13.34 do przed 2.14.0.6, umożliwiając przechowywane XSS.

W Angularze, przed wersjami 21.0.2, 20.3.15 i 19.2.17, zidentyfikowano podatność typu Stored Cross-Site Scripting (XSS) w kompilatorze szablonów. Problem wynika z niekompletności wewnętrznego schematu zabezpieczeń kompilatora, co pozwala atakującym na obejście wbudowanej sanitizacji bezpieczeństwa Angulara.

Snipe-IT before version 8.3.4 is vulnerable to stored XSS via the Locations "Country" field. A low-privileged authenticated user can inject JavaScript that executes in another user's session.

A stored XSS vulnerability in Snipe-IT before version 8.3.4 allows a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

Podatność w Seneka Software dotycząca niewłaściwego egzekwowania workflow behawioralnego pozwala na niewłaściwe wykorzystanie funkcjonalności. Problem dotyczy wersji Onaylarım od 25.09.26.01 do 18112025.

W podatności CVE-2025-13296 występuje luka typu Cross-Site Request Forgery (CSRF) w oprogramowaniu T-Soft E-Commerce firmy Tekrom Technology Inc. Umożliwia ona przeprowadzenie ataku CSRF.

An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.

A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.

A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.

Multiple SQL injection vulnerabilities were discovered in SIGB PMB version 8.0.1.14 in the /opac_css/ajax_selector.php component. The flaws exist in the id and datas parameters.

A vulnerability in Blurams Lumi Security Camera (A31C) firmware v23.1227.472.2926 allows a local physical attacker to execute arbitrary code by overwriting the bootloader on the SD card.

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The issue is in the add() and getPost() functions within ArticleAction.class.php due to improper neutralization of user input in the article title field.

OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php. This allows an attacker to inject malicious scripts into the page, which can be executed in the victim's browser.

eGovFrame Common Components up to version 4.3.1 has an unauthenticated file upload vulnerability via the /utl/wed/insertImage.do and /utl/wed/insertImageCk.do endpoints. An attacker can upload arbitrary content, and the server stores the file and returns a download URL, allowing the application to be used as a file hosting service.

Podatność CVE-2025-11963 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w StarCities, co pozwala na ataki typu Reflected XSS. Problem ten występuje w wersjach przed 1.1.61.

Podatność CVE-2025-0421 dotyczy niewłaściwego ograniczenia renderowanych warstw interfejsu użytkownika lub ramek w oprogramowaniu Shopside firmy Shopside Software Technologies Inc. Problem ten występuje w wersji Shopside do 05022025, umożliwiając wykorzystanie nakładek iFrame.

A Use After Free vulnerability has been identified in the GRUB2 bootloader's normal module. The flaw occurs because the normal_exit command is not properly unregistered when its module is unloaded. An attacker can invoke the command after module removal, causing access to freed memory.

A Use-after-Free vulnerability has been found in the GRUB2 bootloader's 'normal' command. The flaw occurs because the command is not properly unregistered when the module is unloaded, allowing an attacker to access invalid memory locations. Successful exploitation leads to system instability and a complete crash.

A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component due to improper string conversion when reading data from a USB device. A local attacker can connect a maliciously configured USB device during boot sequence, causing GRUB to crash and leading to a Denial of Service (DoS). Data corruption may also be possible, but due to exploit complexity the impact is likely limited.

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges by obtaining the external control key from the config file.