CVE Vulnerability Catalog

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 before 26.02.22.

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI. The code does not limit the schemes allowed in this URL, allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.3.2. Unauthenticated attackers can retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, taxonomies, form scheme metadata, contact options, and custom field meta keys.

A weakness has been identified in PHPGurukul Complaint Management System 1.0, affecting the file user/check_availability.php. Manipulation of the argument email causes SQL injection. Remote exploitation is possible and the exploit has been made public.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0, affecting the file /edit_subject1.php. Manipulation of the argument ID leads to SQL injection. The attack can be carried out remotely and the exploit has been disclosed publicly.

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0, affecting the file /edit_subject2.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely and the exploit has been made public.

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths, allowing a board editor or non-guest team member to grant board admin to arbitrary users.

MLflow prior to 3.15.0 allows authenticated users to create a model version referencing another user's artifact directory and read files without the required READ permission.

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint.

An integer overflow was fixed with improved input validation. The vulnerability affects Apple systems and was resolved in multiple versions. Processing an image may lead to arbitrary code execution.

A use-after-free vulnerability was fixed with improved memory management. The issue affects Apple systems and was resolved in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. A remote attacker may cause unexpected system termination.

9Router in 0.5.4 and earlier does not restrict the issuerUrl parameter in the POST /api/auth/oidc/test endpoint, allowing unauthenticated attackers (when dashboard login is disabled) to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

Dokploy prior to 0.29.6 allows a user with member:create permission to invite an account with the owner role, and a privileged self-hosted user can create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted.

A memory corruption issue was fixed with improved memory handling. The vulnerability affects Safari and Apple systems and was resolved in multiple versions. Processing maliciously crafted web content may lead to memory corruption.

Pandora contains a stored XSS vulnerability in the rendering of URL observables. A malicious URL can be injected into the inline JavaScript onclick handler, allowing arbitrary JavaScript execution in the application context.

SWE-agent's trajectory inspector (sweagent inspector) in v1.1.0 has a path traversal vulnerability in the /trajectory/ handler, allowing unauthenticated network clients to read files outside the intended directory, including JSON files containing repository contents, command output, and secrets.

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and gain administrative control over all users and workspaces.