CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) vulnerability in Open User Map versions up to 1.4.50. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) vulnerability in JetFormBuilder versions up to 3.6.5.1. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

Server-Side Request Forgery (SSRF) vulnerability in Hide My WP Ghost versions up to 7.0.09. Allows an attacker to send requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.

DOM-Based Cross Site Scripting (XSS) vulnerability in Easy Appointments versions up to 4.0.2.1. Allows an attacker to manipulate the DOM of the page in the victim's browser, leading to execution of malicious script.

Missing Authorization vulnerability in Csomagpontok és szállítási címkék WooCommerce-hez before version 4.2.8. Allows exploiting incorrectly configured access control security levels, potentially leading to unauthorized actions.

Missing Authorization vulnerability in Unbounce Landing Pages versions up to 1.1.4. Allows exploiting incorrectly configured access control security levels, potentially leading to unauthorized actions.

A vulnerability in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. Allows an attacker to process malicious XML files, potentially leading to disclosure of sensitive data or unauthorized operations.

Resource exhaustion vulnerability without limits or throttling in Automattic WooCommerce allows HTTP DoS. This affects WooCommerce versions before 11.1.0.

ASUS Control Center Express Agent has missing authentication for a critical function, allowing an unauthenticated nearby user to control the host via a direct connection when the host has an active login session.

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with crafted content, leading to arbitrary code execution in the user's context upon next launch. This results in high impact on confidentiality, integrity, and availability.

SAP Integration Suite does not sufficiently validate XML documents from untrusted sources in certain internal components. An attacker with low privileges could submit crafted XML payloads with malicious external entity declarations, potentially reading sensitive files from the server and exposing them via monitoring or logs, resulting in high confidentiality impact. It could also lead to resource exhaustion, causing low availability impact. No integrity impact.

An unauthenticated user can send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability.

Vulnerability in knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Vulnerability in knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.

Vulnerability in knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

Vulnerability in knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.

Vulnerability in knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

Vulnerability in knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

Resource exhaustion vulnerability in ash_authentication_oauth2_server. An unauthenticated attacker can exhaust database storage and memory by sending requests to the /authorize endpoint with many distinct client_id URLs, creating permanent client rows and caching documents without limits.