CVE Vulnerability Catalog

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL.

The Joomla extension EDocman versions below 3.9 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.

The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.

The HCM system developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, compromising the confidentiality, integrity, and availability of database data.

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

A flaw in the OpenShift GitOps operator allows the ClusterRole reconciler to delete ClusterRole objects without validating ownership. A namespace-scoped Argo CD instance can delete a cluster-scoped ClusterRole by crafting a name collision, causing a denial of service.

The HYPER SBI 2 installer insecurely loads Dynamic Link Libraries. If a crafted DLL is present in the same directory when the installer is invoked, arbitrary code may be executed with the privilege of the user running the installer.

The Quotes llama WordPress plugin before version 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

The Shibboleth WordPress plugin before version 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request carrying identity headers as an authenticated session without verifying them.

A vulnerability in the Aura Wallpaper Service allows a local user to perform file operations by sending crafted commands containing an arbitrary file path, bypassing the service's path restrictions. On specific models, this can also cause a single feature to become unavailable.

A vulnerability in ASUS GameSDK allows a remote attacker to obtain a local user's NTLM hash by tricking the user into visiting a crafted web page that sends a request containing a UNC path to the application's local service endpoint.

A vulnerability in the ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager drivers allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests, bypassing OS-enforced memory protections.

A vulnerability in the ASUS System Control Interface driver and ASUS Business Manager allows a local administrator to disclose sensitive information via crafted IOCTL requests. In severe cases, this may lead to a Denial of Service (DoS) on the system.

A vulnerability was found in the Backend User Endpoint component of xianyu-auto-reply, involving missing authorization. The attack can be initiated remotely via manipulation of the /api/v1/users/ file. The exploit has been made public.

In Rclone before version 1.74.4, a vulnerability exists in the `rclone serve restic --private-repos` component. The authorization mechanism uses the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include `..` in a request (e.g., `//..//config`) and read, overwrite, or delete another user's private repository on backends that clean path components.

A vulnerability in jadx versions 1.5.2 to 1.5.5 allows writing files outside the intended temporary directory when extracting a malicious .xapk file. An attacker can place a JAR file into the plugins/dropins directory, which is loaded as a plugin on the next jadx run, enabling arbitrary code execution.

In Rclone prior to version 1.74.4, when using the -l/--links flag, symlinks are serialized as .rclonelink text objects and recreated on a local destination without validating the target. This allows an attacker-controlled remote to plant an escaping symlink and cause a subsequent object write to land outside the destination with attacker-chosen contents.

A vulnerability in Pi-hole versions 6.0 to 6.4.2 allows a user with code execution as the unprivileged pihole user to escalate privileges to root by replacing the /etc/pihole/logrotate file. The file is then processed by pihole-FTL-prestart.sh, which changes its ownership to root:root, and subsequently executed as root by the daily pihole flush cron, enabling arbitrary code execution with administrative privileges.

A vulnerability in the Twig template library for PHP allows bypassing the sandbox mechanism. The allow-list of filters, tags, and functions is computed when a template instance is created and may remain cached after sandbox state changes between renders.

A vulnerability in the Twig template engine for PHP before version 3.27.0 causes the 'column' filter to pass the sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy.