CVE Vulnerability Catalog

SiYuan to system zarządzania wiedzą osobistą. Przed wersją 3.6.2 istniała podatność, która pozwalała na obejście serwerowego eskapowania atrybutów HTML, co prowadziło do wstrzyknięcia złośliwego kodu JavaScript i umożliwiało atak XSS.

In SiYuan personal knowledge management system prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, the filter FilterBlocksByPublishAccess treats a nil context as authorized, skipping the publish password check and returning bookmarked blocks from protected documents.

APTRS before version 2.0.1 has a privilege escalation vulnerability in the edit_user endpoint (POST /api/auth/edituser/<pk>). Any user can set the is_superuser flag to true for their own or another account, gaining full access without re-authentication.

In Nuxt OG Image prior to version 6.2.5, the lack of restrictions on width and height parameters in the URI /_og/d/ (and /og-image/) allows a DoS attack by generating oversized images.

Multiple D-Link device models (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) up to version 20260205 contain a stack-based buffer overflow vulnerability in the function cgi_adduser_to_session in the file /cgi-bin/account_mgr.cgi. Manipulation of the read_list argument leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

Multiple D-Link device models (including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) up to version 20260205 contain a stack-based buffer overflow vulnerability in the Webdav_Upload_File function of /cgi-bin/webdav_mgr.cgi via the f_file argument. The attack can be performed remotely and the exploit is publicly available.

WWBN AVideo versions 26.0 and prior have a vulnerability in the on_publish_done.php endpoint in the Live plugin that allows unauthenticated users to terminate any active live stream. An attacker can enumerate stream keys from the stats.json.php endpoint and send crafted POST requests to stop broadcasts.

WWBN AVideo up to version 26.0 lacks CSRF token validation in the admin plugin configuration endpoint (admin/save.json.php). Combined with SameSite=None cookie policy, an attacker can forge cross-origin POST requests to overwrite arbitrary plugin settings on an admin session. Bypassing table-level access controls allows full platform takeover.

Admidio versions 5.0.0 through 5.0.7 rely on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, causing Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module is directly accessible over HTTP without authentication to anyone who knows the file path. This issue has been patched in version 5.0.8.

InvoiceShelf prior to version 2.2.0 has an SSRF vulnerability in the PDF generation module. User-supplied HTML in the Notes field is passed unsanitized to the Dompdf library, which fetches remote resources, exploitable via PDF preview and email delivery endpoints.

InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF receipt generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.

Multiple D-Link devices (including DNS-120, DNR-202L, DNS-315L) up to version 20260205 have a stack-based buffer overflow in the UPnP_AV_Server_Path_Del function of /cgi-bin/app_mgr.cgi. Manipulation of the f_dir argument allows remote exploitation.

Lodash versions before 4.18.0 do not properly validate key names in the options.imports option of _.template. An attacker can inject default-parameter expressions that execute arbitrary code during template compilation. Additionally, prototype pollution can lead to similar attacks.

Parse Server before versions 8.6.71 and 9.7.1-alpha.1 allows file downloads via HTTP Range requests that bypass the afterFind(Parse.File) trigger and validators when the storage adapter supports streaming (e.g., default GridFS). This grants unauthorized access to protected files.

InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF estimate generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.

In MinIO, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a PutObject request.

InTouch Contacts & Caller ID app version 6.38.1 allows overwriting critical internal files via the file import process, leading to arbitrary code execution or information exposure.

SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.

The streaming decoder component in aws-c-event-stream before version 0.6.0 has an out-of-bounds write. A server sending crafted event-stream messages can cause memory corruption and potentially remote code execution in the client application.

SciTokens C++ before version 1.4.1 is vulnerable to authorization bypass in path-based scope validation. The enforcer uses simple prefix comparison without path-segment boundaries, allowing a token scoped to one path to authorize access to sibling paths with the same prefix.