CVE Vulnerability Catalog

The QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify specific network packet parameters. This enables certain system functions to access other users' files.

A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery Request Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderHosNum of the file /ssm_pro/orderHos/. Such manipulation of the argument hospitalAddress/hospitalName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user's session and perform actions in their security context.

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in the JavaMall project (cld378632668) in the Upload function of MinioController.java. Input manipulation leads to unrestricted file upload, and the attack can be launched remotely. The product uses rolling releases, so version details are unavailable, and the vendor did not respond to the disclosure.

JFrog Artifactory (Workers) versions from 7.94.0 through <7.117.10 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This could allow execution of malicious script in the user's browser.

A broken access control vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information.

A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized access to device hardware information through insecure API endpoints. Attackers can exploit pet IDs to retrieve serial numbers and MAC addresses, leading to full device control.

A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized access to private audio recordings by exploiting sequential audio IDs and insecure assignment endpoints. Attackers can send requests to /device/deviceAudio/use with arbitrary audio IDs to assign recordings to any device, then retrieve audio URLs to access other users' private recordings.

The vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authentication bypass by exploiting OAuth token validation flaws in the social login system. An unauthenticated attacker can send a request to /member/auth/thirdLogin with arbitrary Google IDs and phoneBrand parameters to obtain full session tokens and account access without proper OAuth verification.

Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft. This issue affects Multi-Stack Controller (MSC) through 2.5.1.

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint.

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml.

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image and /v1/sys/debug endpoints can be abused to access files and disclose host OS, kernel, hardware, and storage details.

Plane (open source project management tool) prior to version 1.2.0 has an issue where the `/api/workspaces/:slug/members/` endpoint is accessible by guest users and allows listing users in a specific workspace. Since the `display_name` in the response is actually the handler of the email, a malicious guest can identify admin users' email addresses.

A buffer overflow vulnerability in QNAP operating systems. A remote attacker with an administrator account can modify memory or crash processes. Fixed in QTS 5.2.8.3332 build 20251128 and later.

A path traversal vulnerability has been reported to affect several QNAP operating system versions. A remote attacker with an administrator account can exploit this vulnerability to read the contents of unexpected files or system data.

A buffer overflow vulnerability affects several QNAP operating system versions. If a remote attacker gains an administrator account, they can exploit the vulnerability to modify memory or crash processes. Fixed in QTS 5.2.8.3332 build 20251128 and later.

A vulnerability in REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy in login attempt responses.