CVE Vulnerability Catalog

PraisonAI before version 1.6.78 contains a remote code execution vulnerability in the plugin manager. It loads and executes arbitrary Python (.py) files from .praisonai/plugins/ directories without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (e.g., via path traversal, supply chain attack, or compromised dependency) achieves arbitrary code execution when the plugin system initializes.

PraisonAI before version 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

PraisonAI before version 4.6.78 contains a remote code execution vulnerability in the JobWorkflowExecutor._exec_inline_python() function due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

A vulnerability in PraisonAI before version 4.6.78 in AgentMail webhook mode fails to verify Svix webhook signatures, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

A vulnerability in PraisonAI before version 4.6.78 allows authentication bypass in the Call API agent invocation endpoints (agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard restricting access to localhost relies on the HTTP Host header, which can be spoofed by an attacker.

PraisonAI before version 4.6.78 unsafely encodes deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters, which execute when the server starts or handles requests.

PraisonAI before version 1.6.78 contains a server-side request forgery (SSRF) vulnerability in the web_crawl tool. It validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

PraisonAI before version 4.6.78 exposes the MCP HTTP-stream transport without authentication by default. When an operator runs the server without an API key, an unauthenticated client can initialize a session, enumerate available tools, and invoke them. Additionally, the server does not validate tool-call arguments against the advertised inputSchema.

PraisonAI before version 4.6.78 has a vulnerability where the default Subprocess Sandbox backend ignores all configured security policies. Blocked commands, paths, imports, subprocess restrictions, and file write restrictions are completely bypassed.

The Grav Flex Objects plugin before version 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, user-controlled frontmatter values are passed to Twig's template_from_string(), causing them to be evaluated as Twig code rather than text. This bypasses Grav's Security::cleanDangerousTwig() sanitization.

phpMyFAQ before version 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint. It allows delegated administrators (non-SuperAdmin) to create SuperAdmin accounts, leading to full instance takeover.

The vulnerability in open-webui before version 0.3.14 is due to a misconfigured CORS policy that allows arbitrary origins (allow_origins=*) and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the open-webui instance by crafting malicious cross-site requests when an admin user visits attacker-controlled websites.

Open WebUI before version 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow. The MIME type of the profile picture URL is inferred from the file extension rather than the Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users visiting the profile image endpoint receive attacker-controlled SVG content, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

An information disclosure vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to enumerate organization IDs via the Supabase PostgREST SECURITY DEFINER RPC function. Different error messages (NO_ORG vs NO_RIGHTS) reveal valid organization identifiers.

Missing authorization in BankAccountListController of Prospero Flow CRM below 5.5.3 allows an authenticated attacker with low privileges to read arbitrary bank account records via the API endpoint without proper role checks.

A vulnerability in Dell PowerScale OneFS allows insertion of sensitive information into log files. A low-privileged attacker with local access could exploit this flaw to disclose confidential data.

An unauthenticated stored XSS vulnerability was discovered in the Joomla extension 4Analytics versions prior to 5.0.2, which may lead to website takeover under some circumstances.

The Joomla extension 4Analytics below version 5.0.2 is vulnerable to unauthenticated stored XSS in the AI analysis feature. An attacker can inject a malicious script that will be executed in other users' browsers.

In Apache Fineract up to version 1.14.0, the Office Search API (GET /api/v1/offices) is vulnerable to SQL injection. The orderBy parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL. This bypasses the ColumnValidator fix for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY clause.

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) up to version 1.14.0. The orderBy and sortOrder parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with client view permission to inject arbitrary SQL via a crafted orderBy value.