CVE Vulnerability Catalog

Dräger SC monitoring devices (models 6002XL, 6802XL, 7000, 8000, 9000 XL) in all software versions have a DoS vulnerability. An unauthenticated attacker can send a malformed network packet causing the monitor to reboot. Repeated attacks can disrupt patient monitoring until network connectivity is lost.

GLPI, a free IT asset management software, in versions 0.50 through 10.0.24 and 11.0.6 allows a technician to read arbitrary files inside the GLPI_DOC_DIR. This is fixed in versions 10.0.25 and 11.0.7.

The unicodedata.normalize() function can consume excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

Cross-site scripting vulnerability in backpack/crud for Laravel. An attacker can conduct a targeted phishing campaign to trick users or admins into clicking a malicious link, which under very specific circumstances could lead to information disclosure or admin access.

The ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker can inject malicious JavaScript that is subsequently executed in other users’ browsers. When chained with CVE‑2025‑11661, it can be exploited remotely without privileges.

Daphne before version 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Since Autobahn defaults both to 0 (unlimited), an unauthenticated remote attacker can send arbitrarily large WebSocket frames or messages, causing excessive memory consumption and denial of service.

An out-of-bounds read vulnerability exists in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library. Insufficient validation of extent header fields before performing a binary search can lead to invalid pointer calculations and out-of-bounds memory read during extent tree traversal.

A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 filesystem image that results in a zero logical block size.

In GPAC Project/MP4Box before version 26.02.0, a NULL pointer dereference exists in the gf_filter_pid_resolve_file_template_ex function in /filter_core/filter_pid.c. An attacker can supply a crafted file to cause a Denial of Service (DoS).

An improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.

Synology Hyper Backup before version 4.1.2-4036 has a path traversal vulnerability in the Backup.Repository webapi component. An authenticated administrator can write specific files containing non-sensitive information outside the allowed directory.

Cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credentials.

Morgan, a popular Node.js logging middleware, has a log forgery vulnerability. The :remote-user token outputs the Basic Auth username without neutralizing control characters, allowing an attacker to inject forged log lines.

A use-after-free vulnerability has been detected in EIPStackGroup OpENer up to version 2.3.0 in the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c in the SendRRData Handler component. Remote exploitation is possible and the exploit has been publicly disclosed.

A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the component Administrative Endpoint. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

The EmergencyWP plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.4.2. Missing nonce validation in the form_settings_ui function allows unauthenticated attackers to modify plugin settings, including the minimum access role, data-erasure-on-uninstall flag, life-check timing values, mandator email address, confirmation page ID, and date/time formats.

The Passeum Ticketing plugin for WordPress up to version 1.0 is vulnerable to Stored XSS. The get_shop_url() method returns the shop_name value without sanitization when it starts with "http", and validate_shop_name() only checks for empty values and string type. Authenticated administrators can inject external scripts by setting shop_name to an attacker-controlled URL. Scripts execute on every page with the plugin shortcode.

A weakness was identified in code-index-mcp up to 2.14.0 in the is_safe_regex_pattern function of the search_code_advanced component. Manipulating the regex argument leads to inefficient regular expression complexity. Remote attack is possible and the exploit is public. Fixed in version 2.14.1.

The wonderwhy-er DesktopCommanderMCP up to version 0.2.38 has a vulnerability in src/search-manager.ts in the start_search function. Manipulating the SearchResult[] argument leads to inefficient regular expression complexity, exploitable remotely.