CVE Vulnerability Catalog

In itsourcecode Fees Management System up to version 1.0, an XSS vulnerability exists in /navbar.php via manipulation of the page argument. The attack can be performed remotely, and exploit is publicly available.

A SQL Injection vulnerability was discovered in itsourcecode Fees Management System 1.0 in the /manage_user.php file. An attacker can remotely manipulate the ID argument to inject SQL code. The exploit is publicly available.

A SQL Injection vulnerability was found in itsourcecode Fees Management System 1.0 in the /manage_student.php file. Manipulation of the ID argument allows remote SQL injection. The exploit is publicly available.

A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Manipulating the pr_profile_image argument leads to unrestricted file upload. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/updates/add_post.php. Manipulating the up_file_to_post argument results in unrestricted file upload. The attack can be initiated remotely and the exploit has been made public.

WordPress Popup Builder plugin version 3.49 contains a persistent XSS vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Scripts execute when popups are displayed.

WordPress Soliloquy Lite plugin version 2.5.6 contains a persistent XSS vulnerability that allows authenticated attackers to inject malicious scripts by inserting script tags in the post title field. Scripts execute when the post is previewed.

WordPress Theme Zoner Real Estate version 4.1.1 contains a persistent XSS vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Scripts execute when an administrator views the property for approval.

The com_jsjobs component in Joomla version 1.2.6 has an arbitrary file deletion vulnerability. Authenticated attackers can delete files by manipulating custom userfield parameters, sending POST requests with path traversal sequences in the field_2 parameter.

GigToDo version 1.3 contains a persistent XSS vulnerability that allows authenticated attackers to inject malicious JavaScript and HTML code through the proposal description field. Scripts execute when an administrator or other users view the stored proposal.

Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie theft or forced redirects to malicious websites.

Contact Form by WD version 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.

Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.

A vulnerability was found in keystonejs keystone up to 20260319 in the GraphQL API Endpoint component. Manipulation of unknown code in output-field.ts leads to resource consumption. The attack can be launched remotely and the exploit is public.

HCL iControl is affected by a weak input validation vulnerability. Expected input of a certain type is not properly validated, which may lead to unexpected behavior.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember from n/a through v10.2.2.

Out-of-bounds write vulnerability in Samsung's rlottie library allows buffer overflows. The issue affects versions before commit dcfde72eae1b0464dc0dd760aec00ada6a148635.

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrary IMEI numbers. This allows unauthorized actors to list catalog items and extract protected binaries from pre-signed cloud links.

The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall limits, making internal API endpoints reachable over the WAN.

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.