CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

298 matches found

Kitploit•added 2026/09/18 12:12 p.m.•12 views

CVE-2025-5352

CVE-2025-5352 在 lunary-ai/lunary 的 Analytics 组件中发现了一个存储型跨站脚本（XSS）漏洞。该问题源于 NEXTPUBLICCUSTOMSCRIPT 变量通过 dangerouslySetInnerHTML 直接注入到 DOM 中，且未经过适当的清理或验证。如果攻击者能够控制该变量（无论是在部署过程中还是通过服务器入侵），他们就可以注入任意 JavaScript 代码。该恶意脚本将在所有访问受影响应用程序的用户浏览器中执行，可能导致会话劫持、凭据窃取或其他客户端攻击。...

9.6CVSS7.5AI score0.00497EPSS

SaveExploits1

OSV•added 2026/02/02 11:16 a.m.•12 views

CVE-2024-4147

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations through ID manipulation. The vulnerability stems from the application's failure to validate the ownership of the prompt before deletion, on...

6.5CVSS5.8AI score0.00412EPSS

SaveExploits1References2

NVD•added 2026/02/02 11:16 a.m.•15 views

CVE-2024-5386

In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...

9.6CVSS0.00511EPSS

SaveExploits2References2

NVD•added 2026/02/02 11:16 a.m.•17 views

CVE-2024-4147

7.5CVSS0.00412EPSS

SaveExploits1References2

EUVD•added 2026/02/02 10:36 a.m.•15 views

EUVD-2024-55392

9.6CVSS5.5AI score0.00511EPSS

SaveExploits2References2

NVD•added 2025/11/25 1:15 a.m.•20 views

CVE-2025-9803

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' audience field in the access token issued by Google, which is crucial for ensuring the token is intended for the...

9.3CVSS0.00472EPSS

SaveExploits2References2

EUVD•added 2025/10/03 8:07 p.m.•11 views

EUVD-2024-32334