CVE Vulnerability Catalog

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously.

MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text.

MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. Sample tag names from unknown galaxy clusters are inserted into HTML without entity encoding, allowing a user with tag-editor privileges to inject malicious script. A site administrator viewing the Galaxies page executes that script in their browser session.

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the /authorize file of the HTTP Request Handler component. Manipulation of the Success argument leads to HTTP response splitting, exploitable remotely, and the exploit has been publicly disclosed. This vulnerability only affects products no longer supported by the maintainer; current supported releases (X10, X11, Velocity 5.x+) have no validated evidence of impact.

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX, affecting the Location Header Handler component. Manipulation of the Host argument results in an open redirect, exploitable remotely, and the exploit has been made public. This vulnerability only affects products no longer supported by the maintainer.

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service).

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup, causing the embedded script to execute in the browser context of any user who opens the galaxy matrix statistics page.

Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax and certain unsanitised content blocks.

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation is possible, and the exploit has been disclosed publicly and may be used.

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely, and the exploit has been made available to the public and could be used for attacks.

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete. This allows unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting. This allows unauthenticated users to execute arbitrary shortcodes registered on the site.

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart. This allows unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely, and the exploit is publicly available and might be used.

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be utilized.

A flaw was found in the Admin REST API of Keycloak. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control.

A flaw was found in the Authorization Services component of Keycloak. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details.

A vulnerability was discovered in the Feiyu Star Router B-MB5E202-210322-r11656 (Chengdu Feiyuxing Technology) in /send_order.cgi?parameter=del_expmac. Manipulation of the mac argument leads to command injection. The attack can be launched remotely and the exploit has been publicly released.