CVE Vulnerability Catalog

The Joomla extension JMedia versions below 1.6.0 is vulnerable to authenticated arbitrary file upload. An authenticated attacker can upload executable files (including with polyglot filenames), and chmod does not strip execute bits, leading to remote code execution (RCE).

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form. An unauthenticated attacker can execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover.

Vulnerability in Network-AI (TypeScript/Node.js) before version 5.9.1 allows bypassing the shell command allowlist. An attacker can execute arbitrary commands by injecting special characters (e.g., `;`).

xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.

A vulnerability in the Piwigo installer versions 16.3.0 and earlier allows PHP code injection via POST parameters for database configuration. Lack of proper input sanitization and bypass of `addslashes()` on PHP 8+ enables an unauthenticated attacker to write malicious code into a configuration file, executed on every page load.

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

An inverted-boolean bug in lettre's `boring-tls` integration (versions 0.10.1 to 0.11.21) silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker can present any chain-valid certificate for any domain and intercept SMTP submission, including PLAIN/LOGIN credentials and message contents. Other TLS backends (native-tls, rustls) are unaffected. Version 0.11.22 patches the issue.

Malicious versions of the npm package @beproduct/nestjs-auth (0.1.2–0.1.19) contained a postinstall script that exfiltrated npm tokens, GitHub tokens, AWS credentials, Vault tokens, and other secrets. Version 0.1.20 is a clean republish.

HeyForm prior to version 3.0.0-rc.7 contains a stored XSS vulnerability in the form builder. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation.

An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.

An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.

A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only checks that paths do not begin with "/" but fails to block sequences like "../". An authenticated administrator can craft a relative_path containing traversal sequences, allowing arbitrary file write to any location writable by the Pulp service user.

A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.

A heap-based buffer overflow in FreeRDP before version 3.28.0 (affected <=3.27.1) in the crypto_rsa_common() function. The function writes the modular exponentiation result to the output buffer before checking bounds, allowing out-of-bounds writes.

Vulnerability in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert, so client certificates were not validated. A remote attacker can connect as an unauthenticated agent and intercept control-plane-to-node traffic.

Vulnerability in Crypt::Password for Perl up to version 0.28 causes generation of insecure, predictable salt values using the built-in rand function, which is unsuitable for cryptographic purposes.

The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).