CVE Vulnerability Catalog

A vulnerability in the Neo4J component of Apache Camel allows Cypher injection through property names in the CamelNeo4jMatchProperties map. Although property values are bound as parameters, JSON key names are concatenated verbatim into the query, enabling an attacker to alter the query structure and perform arbitrary operations on the Neo4j database.

Untrusted data deserialization vulnerability in Apache Camel's PQC component allows remote code execution via a crafted Java object. The flaw stems from missing input filtering when reading post-quantum key metadata from HashiCorp Vault, AWS Secrets Manager, and local file backends.

A vulnerability in the Apache Camel Lucene component allows improper input validation and authorization bypass via a user-controlled key. An attacker can set the QUERY header in an HTTP request to execute arbitrary Lucene queries, including reading the entire index or performing expensive regex queries, without proper credentials.

Improper input validation in Apache Camel's camel-nats component allows injection of Camel control headers via NATS messages. The missing header filtering lets attackers modify Camel route behavior, such as redirecting HTTP requests or changing file names.

In SUSE Rancher AI Agent versions 1.0 before 1.0.2, when DEBUG log level is set, API keys or LLM response text with potentially sensitive data may be leaked into log files. A local attacker could misuse the obtained data or credentials.

A vulnerability in Apache Camel (JMS components) allows deserialization of untrusted data by bypassing the CVE-2026-40860 fix. An attacker can publish a JMS ObjectMessage with a DefaultExchangeHolder object, which passes the allow-list check, and then write arbitrary data into the Camel Exchange, manipulating routing, headers, and properties.

Deserialization of untrusted data vulnerability in Apache Camel Hazelcast component. The default Hazelcast configuration applies no deserialization filter, allowing an attacker to achieve remote code execution by sending a crafted Java object to the Hazelcast cluster. Affects versions 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0.

Deserialization of untrusted data vulnerability in Apache Camel allows an attacker to trigger DNS queries by delivering a crafted Java payload. The issue stems from the default ObjectInputFilter pattern that permits java.net.URL and java.net.InetAddress classes, enabling data exfiltration via an out-of-band DNS side channel.

A vulnerability in Apache Camel allows remote code execution via deserialization of untrusted data in the camel-vertx-http component. An attacker can exploit a man-in-the-middle position or compromised backend to deliver a crafted Java object, leading to code execution on the Camel host.

An uncontrolled resource consumption vulnerability exists in Apache IoTDB. Some interfaces fail to impose reasonable limits on the time span and aggregation interval of queries, allowing an attacker to craft a request with extreme parameters, leading to Java heap exhaustion and DataNode crash.

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

A vulnerability was found in create-react-app up to version 5.0.1 on macOS. The startBrowserProcess function in openBrowser.js of the react-dev-utils component allows OS command injection. Remote exploitation is possible and the exploit is publicly available.

The Admin and Site Enhancements (ASE) WordPress plugin before version 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.

The FileOrganizer WordPress plugin before version 1.2.0 does not validate file types in several file management operations, allowing authenticated users with file manager access (which its premium add-on can extend to sub-administrator roles) to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file type validation to the upload operation.

The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escapes a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

The Ultimate Member WordPress plugin before version 2.12.0 fails to properly sanitize and escape custom textarea profile field values before outputting them on user profiles. This allows authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

The AllCoach WordPress plugin before version 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password. This allows unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

The Notifications for Forms & WordPress Actions plugin before version 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path. This allows authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0 in the /ajax_enroll.php file of the Enrollment Management component. Manipulation of the student_id, schedule_id, or action arguments leads to improper authorization, allowing unauthorized access.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0/1.php in the file /edit_course1.php. An unknown function allows manipulation of the ID argument, leading to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.