CVE Vulnerability Catalog

The Smart Slider 3 plugin for WordPress up to version 3.5.1.37 inclusive is vulnerable to Sensitive Information Exposure via the 'keyword' parameter. This allows authenticated attackers with contributor-level access or higher to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts from any user, including Administrators and Editors.

Cross-site scripting vulnerability in phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The validation functions fail to detect a scheme when the input starts with an ASCII control character or space, enabling code injection.

Laravel-Mediable before version 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements.

A vulnerability in Firefox for iOS allowed malicious page titles to overwrite saved PDF files or bundled content within the application sandbox. This issue was fixed in version 152.4.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows a remote unauthenticated attacker to read JSON files outside shared folders by manipulating the 'lang' query parameter. Exploitation is limited to files with a narrow naming and format pattern, reducing practical impact.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows XSS attacks due to improper escaping of file names in the basic web listing. An attacker with upload permissions or an anonymous user can upload a file with a malicious name that executes a script in the victim's browser.

Rejetto HFS versions 3.0.0 through 3.2.0 return observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows state-changing API requests via the GET method, which is exempt from anti-CSRF header checks. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed.

Blender 3.0.0 through 5.1.2 has an out-of-bounds read vulnerability via a crafted .blend file with a malicious member_index in the SDNA block. Missing bounds validation causes a crash (SIGSEGV) or heap memory disclosure.

In the Linux kernel vsock/virtio driver, there is a bug in zerocopy handling for large messages fragmented into multiple skbs. The uarg object is allocated only for the last skb, causing missing completion notifications for earlier skbs and potential page leak if the loop breaks early.

In the Linux kernel, a memory leak exists in the hci_le_big_terminate() function. The function allocates iso_list_data but fails to free it in an early return path when neither pa_sync_term nor big_sync_term flags are set.

A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/accept.php. An attacker can remotely manipulate the appid argument, leading to SQL injection. The exploit is publicly available.

A vulnerability in the Tempo Operator's gateway component causes inconsistent namespace-scoped redaction in query API responses when RBAC is enabled. This allows an authenticated user to read span attributes belonging to other tenants' namespaces.

A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/deletemp.php. Manipulation of the ID argument allows remote SQL injection. The exploit has been publicly disclosed.

A vulnerability in Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19 fails to check the manage_shared_channels permission in the /share-channel autocomplete handler. This allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.

A vulnerability in Mattermost allows an authenticated user with team access to modify metric settings in another user's playbook via a crafted import or update request with a foreign metric ID. Affected versions are 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19.

The Car Rental Manager WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.7.

The Church Admin WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.0.30.

The JetSearch WordPress plugin (versions up to 3.6.1.2) contains a vulnerability that allows unauthorized users to access sensitive system information. This flaw enables reading embedded sensitive data, potentially leading to information disclosure.