Threat database

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.

Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.

A hacker leaked over 41,000 records of US Department of Homeland Security employees, allegedly stolen from an Okta single sign-on system. The leaked data includes personal and work information such as names, work emails, phone numbers, job titles, office locations, and access details to internal systems and applications. The breach affects employees from multiple DHS agencies, including Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations, and CISA. The leak provides attackers with detailed access information, potentially enabling targeted attacks on critical personnel and systems.

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module. This flaw allows users with Clinician-level privileges to manipulate database contents by submitting crafted input to a specific POST parameter. Exploitation can lead to reading sensitive data such as bcrypt password hashes and executing queries that reset passwords, enabling full administrative account takeover. The vulnerability is fixed in version 8.5.0.

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

The MW WP Form plugin for WordPress versions up to and including 5.1.7 is vulnerable to sensitive information exposure via the 'post_id' parameter. This vulnerability allows unauthenticated attackers to enumerate sequential post IDs and extract personally identifiable information such as names, email addresses, and message contents from other users' form submissions. Exploitation requires the targeted form to have the querystring setting enabled, which is a standard documented feature of the plugin.

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) flaw via the 'type' parameter in all versions up to and including 9.3.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.

The Yamaha wireless LAN router NWR100 contains an OS command injection vulnerability that allows an attacker to execute arbitrary operating system commands by sending a specially crafted request. This vulnerability has a critical severity with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the SABBATIC application. This flaw allows an attacker to trick an authenticated user into performing unauthorized actions by clicking a malicious link or loading a crafted page that sends requests to vulnerable endpoints without the user's consent. The vulnerability has a medium severity rating with a CVSS score of 4.8.

YMS-VPN8 and YMS-VPN8-CP from Yamaha Corporation have a vulnerability where Windows services are registered with unquoted file paths. This can allow a user with write permissions on the system drive to execute arbitrary code with SYSTEM privileges.