CVE Vulnerability Catalog

In Eclipse Theia up to version 1.69.0, opening a folder starts source control integration without first asking the user to trust the folder. Applications built on Theia that include git integration execute git commands (e.g., git status) as soon as a repository is detected. Because git honors repository-local configuration, a folder with an attacker-controlled .git/config containing core.fsmonitor can cause the configured command to be executed. Cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with user privileges, without any confirmation prompt.

In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue.

In KUNBUS piControl version 2.6.2, a CWE-362 race condition vulnerability exists in the configuration and process-image management functionality. It allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects by sending concurrent crafted requests through the piControl character device, leading to kernel memory corruption and denial of service.

In KUNBUS piControl version 2.6.2, a CWE-787 out-of-bounds write vulnerability exists in the process-image management functionality. It allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, by supplying crafted device configuration data and input through the piControl character device, leading to kernel memory corruption and denial of service.

Datavane TIS v5.0.0 contains an XML External Entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration. The vulnerability arises from processing XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document with an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files, including configuration files and Derby database credentials.

The JSON plugin in Apache Struts has an uncontrolled resource consumption vulnerability. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. Affected versions: Apache Struts from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

In Devolutions PowerShell Universal version 2026.2.3 and earlier, a code injection vulnerability exists in the settings feature. An authenticated user with settings management permission can execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.

In the payroll module in Roskus Prospero Flow CRM before 5.15.10, an authorization bypass through user-controlled key vulnerability exists. Authenticated users holding the read payroll permission can view salary and banking details of employees of any other company in the instance, and users holding the create payroll permission can create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership.

In alldatacenter alldata up to version 0.6.8, a deserialization vulnerability exists in the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java in the xxl-rpc Listener component. The manipulation results in deserialization, and the attack can be performed remotely. The exploit is now public and may be used. The project closed the issue report as 'not planned' without further explanation.

In SourceCodester Simple Client Management System 1.0, a SQL injection vulnerability exists in an unknown function of the file /classes/Master.php?f=save_service. Manipulation of the argument ID leads to SQL injection. The attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A stack-based buffer overflow vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the ipMacBindListStore function of /goform/addIpMacBind. Manipulating the IPMacBindRule argument can lead to buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the formQOSRuleDel function of /goform/delQos. Manipulating the qosIndex argument results in buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.

The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin()-gated write endpoints (in GroupsController, AccountsConfigController, PreferencesController, and DashboardWidgetController). These endpoints authorize via a super-admin early-return that never invokes requirePermission()—the sole enforcement point of the scope cap—so a 'read-only'-scoped key (e.g. api.pages.read) can perform super-only write operations, including rewriting group ACL maps to grant super-admin privileges to arbitrary accounts. A leaked or delegated read-only CI/monitoring key can therefore gain full super-admin write capability. Fixed in 1.0.13.

The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. An attacker holding an API key scoped to api.config.write that was minted on a super account can therefore inject arbitrary commands into scheduler.custom_jobs, which Job::run() passes to a Symfony Process, achieving operating system command execution as the web server user.

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only for api.users.write, but gate super-privilege grants on a bare isSuperAdmin() check that reads access.api.super directly without consulting the key's scopes. As a result, an api.users.write-scoped key minted on a super account can set access.api.super or assign a super-granting group to mint or promote a full super account, then authenticate as that account for uncapped administrative privileges.