All CVEs — page 5 of 1220
The complete archive, 25 per page, newest first. 30483 records. Search instead.
AstroBlocks prior to v3.4.0 uses a hard-coded JWT secret as a fallback, and due to an environment variable naming mismatch, attackers can bypass authentication by forging valid admin session tokens with 'owner' privileges. This allows full administrative control over the CMS, including content, user, and configuration manipulation.
Nitrite DB versions prior to 4.4.1 deserialize untrusted data from legacy database files using Java ObjectInputStream without class filtering, enabling arbitrary code execution via gadget chains when malicious serialized objects are present in the database file. This is a deserialization flaw (CWE-502) with CVSS 9.8 due to remote exploitability and full confidentiality/integrity/availability impact.
Waline comment system versions 3.15.2 and prior contain a stored XSS vulnerability where untrusted HTML in a commenter's body is rendered unsanitized in an administrator's live preview when editing the comment, enabling privilege escalation via social engineering.