CVE Vulnerability Catalog

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

An SQL injection vulnerability has been discovered in GisLab Laboratory Management System due to improper neutralization of special elements in SQL commands. The flaw affects versions from 1.4.03 through 08072026.

In the halo2_gadgets library up to 0.5.0 and related Zcash components (zebrad, orchard, zcash_primitives, zcashd), there is a vulnerability due to missing a copy constraint for the base point in the variable-base scalar multiplication gadget. This allows a malicious prover to generate a valid proof for an Orchard Action with an under-constrained base point, bypassing the diversified-address-integrity check.

A missing authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows accessing functionality not properly constrained by ACLs. This issue affects versions from 3.11.0.0 before 3.25.0.

An authorization bypass vulnerability in Vimesoft Inc. Enterprise Video Platform allows accessing functionality not properly constrained by ACLs through a user-controlled key. The issue affects versions from 3.11.0.0 before 3.25.0.

An unverified password change vulnerability in Vimesoft Enterprise Video Platform allows authentication bypass. Affects versions from 3.11.0.0 before 3.25.0.

The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.

An XML External Entity (XXE) vulnerability was discovered in libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7. It allows an attacker to load external XML entities, potentially leading to file disclosure or unauthorized requests.

A business logic vulnerability in HCL Aftermarket EPC allows an unauthorized user to obtain passwords from the server by manipulating server responses. Lack of validation on email requests enables redirecting passwords to the attacker's own email address.

The AI Copilot WordPress plugin before version 1.5.4 does not bind OAuth access tokens to a WordPress user and accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

The Aimogen Pro WordPress plugin contains a privilege escalation vulnerability. Missing capability checks in the 'aiomatic_call_google_ai_function' function allow unauthenticated attackers to use the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, including creating administrator accounts.

The clawvet self-hosted API server before version 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as default in .env.example. Additionally, GET /api/v1/scans returns scan records containing userId values without authentication, allowing a remote unauthenticated attacker to harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey.

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form.

Jupyter Enterprise Gateway before version 3.3.0 interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., securityContext), and inject document boundaries (---, ...) to create arbitrary resources, including privileged pods.

Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.3.0 are vulnerable to Server Side Template Injection (SSTI) via KERNEL_XXX environment variables used during Kubernetes manifest rendering. Attackers can execute Python code and OS commands within the Enterprise Gateway service.

In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.

A vulnerability in Zoom Desktop Client for Windows, VDI Client, and Meeting SDK allows an unauthenticated attacker to perform account takeover over the network. The issue stems from improper input validation.

Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.3.0 have a vulnerability that bypasses the UID/GID restriction preventing kernel launches as root. A specially crafted KERNEL_UID or KERNEL_GID value allows running kernels as root, increasing the attack surface and potentially leading to container escapes, compromising worker nodes and the entire Kubernetes cluster.

A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.