CVE Vulnerability Catalog

A SQL Injection vulnerability was found in Online Job Portal 1.0 in the file /Admin/EditUser.php. An attacker can remotely manipulate the UserId argument, leading to SQL injection. The exploit is publicly available.

The Newsletters WordPress plugin before version 4.15 fails to prevent deserialization of untrusted input submitted via a public form. This allows unauthenticated attackers to inject a PHP object and, through a property-oriented gadget chain, write arbitrary files and execute code on the server.

The AI Engine WordPress plugin before version 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.

A vulnerability in the SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file. Processing this file by the application's library triggers insecure deserialization, leading to remote code execution (RCE) on the system.

A vulnerability in SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript via crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, enabling the attacker to access sensitive session information and modify non-sensitive data displayed in the client's browser.

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access.

SAProuter on Microsoft Windows allows an unauthenticated attacker to load DLL files from an untrusted location, enabling arbitrary code execution. The attacker can hijack the DLL loading process and achieve remote code execution.

HedgeDoc before version 1.11.0 was vulnerable to a YAML alias bomb in note frontmatter. Unsafe parsing with js-yaml.load expanded YAML anchor aliases, creating huge object structures and excessive CPU consumption. An attack could block the Node.js event loop for about 235 seconds per request, causing denial of service (DoS).

A vulnerability in the Crypt::OpenSSL::X509 library for Perl before version 2.1.3 causes denial of service (DoS) via NULL pointer dereference. The X509V3_EXT_d2i(ext) function returns NULL when parsing an extension's DER value fails, and helper functions (basicC, ia5string, auth_att) do not check the result before dereferencing. Additionally, keyid_data dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when parsing succeeds.

A path traversal vulnerability was found in Cockpit CMS's Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}, and the WhitespacePathNormalizer resolves 'buckets/..' to the empty string (the uploads storage root) without raising PathTraversalDetected because the '..' has a preceding component to consume.

Cockpit CMS has a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.

Spring Boot Admin Server before version 4.1.2 contains a server-side request forgery (SSRF) vulnerability. Unauthenticated attackers can register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints.

CrewAI before version 1.15.1 contains a server-side request forgery (SSRF) vulnerability in the validate_url function, which performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of the host exec environment, allowing abuse of Git ext transport. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of interpreter startup variables in the host exec environment. This allows a lower-trust caller to supply crafted environment variables, potentially leading to execution or persistence of actions beyond intended authorization.

A vulnerability in OpenClaw before version 2026.6.6 allows bypassing security policy during browser CDP discovery by accepting blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

An authorization bypass vulnerability in OpenClaw versions 2026.3.22 through 2026.6.6 allows WhatsApp group IDs to satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation.

An authorization bypass vulnerability in OpenClaw versions 2026.5.20 through 2026.6.6 in the MCP loopback feature allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks via configured input paths to perform or persist actions beyond their intended permissions.

In OpenClaw versions 2026.5.20 before 2026.6.9, a privilege escalation vulnerability exists in plugin install commands. It allows lower-trust callers to execute or persist actions beyond their intended authorization.