CVE Vulnerability Catalog

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_facnote.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in opena.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized frm_call GET parameter that is directly output on the page.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in patient_JF.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into a JavaScript variable assignment.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in add_note.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into the VALUE attribute of a hidden input field.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized ticket_id GET parameter that is directly placed into an HTML attribute.

Open ISES Tickets before version 3.44.2 contains a reflected XSS vulnerability in single_unit.php. An authenticated attacker can inject arbitrary JavaScript via an unsanitized id GET parameter that is directly placed into an HTML attribute.

ArcGIS Server has an input validation weakness in the login redirection workflow. An authenticated attacker can send a crafted request, causing the browser to redirect to an untrusted site, resulting in limited confidentiality impact under specific user interaction. The vulnerability affects ArcGIS Server 11.5.

ArcGIS Server has an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker can send a crafted request to this endpoint, potentially disrupting the web-based browsing interface. This affects ArcGIS Server 12.0 and earlier.

CryptPad before 2026.2.0 has an HTML sanitizer bypass in Diffmarked.js. The sanitizer only validates the src attribute of <iframe>, <video>, and <audio> elements, leaving other attributes like srcdoc unchecked. An attacker can inject arbitrary HTML, defeating bounce sandboxing.

Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.

In Splunk Enterprise before versions 10.2.2, 10.0.5, 9.4.11, 9.3.12 and Splunk Cloud Platform before specified versions, a low-privileged user (without admin or power roles) can cause a denial of service (DoS) by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user without 'admin' or 'power' roles could access confidential data restricted by `srchFilter` configurations on custom roles. The app contains an `authorize.conf` file with a `srchFilter` entry that modifies the built-in 'user' role. Because Splunk combines inherited search filters with the `OR` SPL operator, the injected filter overrides more restrictive filters on child roles.

Prototype pollution in CSV parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior, enabling '1-click' command execution.

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

In Keycloak, the cross-session verification proof is keyed only by (localUserId, idpAlias) and is not bound to the upstream identity. A second upstream account on the same IdP can consume it and get linked to the victim's local account.

InfoScale VIOM version 9.1.3 contains an XSS vulnerability.

SQL injection vulnerability in InfoScale VIOM before version 9.1.3 allows remote attackers to escalate privileges.

Cisco ThousandEyes Enterprise Agent has a vulnerability in the BrowserBot component that allows an authenticated remote attacker to execute arbitrary commands in the BrowserBot container as the node user. The vulnerability is due to insufficient input validation of command arguments.

A vulnerability in Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with admin privileges to execute arbitrary code as root by uploading a crafted SSL certificate.

Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode have a vulnerability in the BGP enforce-first-as feature. Incorrect parsing of a transitive BGP attribute allows an unauthenticated, remote attacker to trigger BGP session flaps, leading to denial of service.