Waline versions 3.15.2 and earlier contain a stored cross-site scripting (XSS) vulnerability in the comment editor's live preview feature. The vulnerability arises because the preview uses the marked library without sanitization and injects HTML via v-html. When an administrator edits a comment, the raw, unsanitized comment body is rendered, allowing an unauthenticated attacker to execute stored XSS in the administrator's session by tricking them into clicking Edit on a malicious comment. No patches are publicly available at the time of disclosure.
Waline versions 3.15.2 and earlier contain a stored cross-site scripting (XSS) vulnerability in the @waline/client UserList widget. The widget inserts commenter nicknames and links directly into the DOM without HTML escaping, allowing an unauthenticated attacker to inject malicious scripts via the link field. This script executes automatically in the browsers of all visitors viewing the UserList widget. No patches are publicly available at the time of disclosure.
Padloc versions from 4.0.0 up to but not including 4.3.1 contain an authentication bypass vulnerability in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email address to brute force the 6-digit multi-factor authentication code without incrementing the attempt limit. Successful brute forcing can yield verification tokens that are usable in signup, login, and account recovery processes.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a denial of service vulnerability in the ElasticStore and SPARQLStore components. This flaw arises from the ConceptDescriptionInterpreter classes re-expanding concepts without memoization or limiting expansion, allowing users with page-edit rights to create acyclic chains of Concept: pages that cause excessive CPU and memory consumption during queries. The vulnerability can be triggered via concept page views, Special:Ask, or the api.php action=ask endpoint.
Padloc versions 4.0.0 up to but not including 4.3.1 contain a prototype pollution vulnerability. This flaw allows SCIM token holders to modify the Object.prototype by sending specially crafted SCIM PATCH requests to the ScimServer._handleScimUsersPatch() function. By manipulating paths such as __proto__.x or constructor.prototype.x, attackers can pollute the shared server process, potentially disrupting requests for all organizations served by that process. The vulnerability has a high severity rating with a CVSS score of 7.6.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the ValueFormatter::getFormattedSubject() function. This flaw allows users with page-edit rights to inject malicious markup via a preferred property label containing an img onerror payload. The payload executes when any user, including administrators, views the Special:Browse page or uses the smwbrowse API. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.
Semantic MediaWiki versions from 7.3.1 up to but not including 7.4.1 contain an incorrect authorization vulnerability in the EditProtectionUpdater::userMayChangeProtection() function. This flaw allows editors to bypass edit and move protection by adding a specific template code that removes administrator protections logged under the administrator's name. The vulnerability can lead to unauthorized changes despite protection mechanisms.
Mbin versions from 1.2.1 up to but not including 1.11.1 contain a stored cross-site scripting (XSS) vulnerability in the EmbedElement::buildDestructed() function. This flaw allows authenticated users to inject HTML in the alt text of images nested inside links within various user-generated content fields, such as entries, comments, posts, messages, or bios. The vulnerability arises because the alt text and URL are rendered without proper HTML escaping, enabling script execution in the browsers of users who view the affected content.
Semantic MediaWiki versions from 2.4.0 up to but not including 7.4.1 contain a reflected cross-site scripting (XSS) vulnerability in the TimeValueFormatter::getCaptionFromFreeFormat() function. This flaw allows unauthenticated attackers to craft a Special:Ask URL with malicious HTML markup in a date printout format, which is then emitted without proper escaping. When a logged-in user accesses such a URL, the injected script executes in their browser session, potentially compromising confidentiality and integrity.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the Special:Ask feature when using the ElasticStore backend. This flaw allows users with edit permissions to inject malicious scripts via unescaped native_result and score_set outputs. An attacker can embed harmful markup in a Text property or subobject name and then trick other users, including administrators, into visiting a crafted Special:Ask link, resulting in script execution within their sessions.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter. This flaw allows users with page-edit rights to create mutually referencing concept pages, which can cause concept page views, Special:Ask queries, or api.php action=ask queries to exhaust PHP memory or stack resources, resulting in denial of service.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.4.1 contain a missing authorization vulnerability. This flaw allows editors who do not have the edit-protection right to lock pages by adding an 'Is edit protected' annotation. By adding [[Is edit protected::true]] to pages or setting it in widely transcluded templates, attackers can cause the TitleQuickPermissions hook to block other editors and administrators from editing, moving, or deleting affected pages indefinitely.
Jellyfin versions prior to 12.0 have a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. This flaw allows unauthenticated attackers to delete or move directories by supplying crafted library names such as '..' or absolute paths before setup completes. Exploitation can lead to recursive deletion of the data directory and the jellyfin.db database file.
Viber for iOS versions up to 29.4.0.24 contains a vulnerability where the app does not properly validate the logical screen width and height in received GIF headers. An attacker can exploit this by sending a crafted GIF with zero dimensions, causing the app to crash due to an uncaught exception.
WWBN AVideo versions up to 29.7.1 have a vulnerability in the PayPalYPT plugin's ipnV2.php file that allows improper payment verification. Attackers can exploit this flaw by forwarding verified PayPal recurring payment notifications (IPNs) from their own PayPal accounts with a chosen user ID, resulting in unauthorized wallet crediting. This vulnerability does not require authentication and can be exploited repeatedly each billing cycle.
WWBN AVideo versions 6.5 through 29.7.1 have an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user by exploiting the Hybridauth social login feature. Attackers can impersonate victims by setting their social login display name to the victim's username and omitting the email, enabling access without a password, including administrator accounts.
1Panel-dev CordysCRM versions before 1.9.6 have an authorization bypass vulnerability in the CustomerContactController.get method. This flaw allows authenticated users with ordinary contact or customer read permissions to access contact information of other users without proper organization, owner, or data-scope checks. Exploitation involves sending a GET request to /account/contact/get/{id} with another contact's ID to retrieve sensitive details such as names, phone numbers, owners, departments, linked customers, and custom fields.
Directus versions before 12.1.0 have an authorization bypass vulnerability. This flaw allows unauthenticated attackers to bypass permission checks on public-mode WebSocket connections by sending a failed authentication message with an invalid token. As a result, attackers can perform read, create, update, or delete operations on any user-defined collection without proper authorization.
LimeSurvey Community Edition 7.8.0 has an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can craft a .lsa archive that leads to execution of attacker-controlled SQL commands when exporting responses from the imported survey. This occurs because attribute names containing parentheses are treated as SQL expressions rather than quoted identifiers.
WWBN AVideo versions up to 29.7.1 have a missing authorization vulnerability in the API::get_api_tags() function within the plugin/API/API.php file. This flaw allows registered users to access restricted video data by querying the tags API. Exploitation enables attackers to subscribe to tags and retrieve filenames, titles, and stored video_password values of unlisted, group-restricted, and password-protected videos, potentially allowing unauthorized viewing.