CVE Vulnerability Catalog

The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

The Starter Templates plugin (astra-sites) up to version 4.7.7 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

In the vgmstream library up to revision r2117, a vulnerability was found in the decode_ms_ima function in src/coding/ima_decoder.c (Microsoft IMA Decoder component). Manipulation leads to a divide by zero, and the attack can be executed remotely.

In the vgmstream library up to revision r2117, a weakness was found in the make_group_random function in src/meta/txtp_process.c (TXTP File Handler component). This manipulation causes a use-after-free, and the attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024.

In the vgmstream library up to revision r2117, a vulnerability was found in the parse_params/txtp_parse functions in src/meta/txtp_parser.c (TXTP File Handler component). The manipulation results in an out-of-bounds write, and the attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b.

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

The pwhois tool in Net::Whois::Raw before version 2.99044 for Perl queries WHOIS for the wrong domain for unicode domain names. The punycode encoding skips IDNA mapping and normalization steps, leading to incorrect A-labels for certain characters.

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the server_info function of the file python/sglang/srt/entrypoints/http_server.py of the HTTP Endpoint component. Manipulation of the api_key argument leads to cleartext transmission of sensitive information. The attack can be launched remotely, though it is highly complex and difficult to exploit. The exploit has been disclosed to the public and the pull request to fix this issue awaits acceptance.

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

An improper access control vulnerability exists in GROWI, which allows an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

YAML before version 1.27_001 for Perl allows a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. The document can enable code loading options that are off by default.

YAML before version 1.30 for Perl allows a loaded document to trigger the DESTROY method of arbitrary classes. The perl/hash:Class tag blesses a hash into the class it names, and Perl calls DESTROY when it goes out of scope.

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the plugin's authenticated download mechanism.

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection, allowing them to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm.