CVE Vulnerability Catalog

In CubeCart prior to 6.7.5, the GDPR tools rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts.

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.

In CubeCart prior to 6.7.5, admin/sources/products.index.inc.php reads rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before storing and rendering through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content.

In CubeCart prior to 6.7.5, the _errorMessage method uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session.

In CubeCart prior to 6.7.5, the delete-note handler verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data.

In CubeCart prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action use state-changing GET requests and are omitted from the protection map in csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens.

In Hamlib prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 triggers an out-of-bounds stack write (NUL byte past a 200-byte buffer) and an oversized copy of uninitialized stack data. Under the default no-password configuration, a remote client can trigger both flaws with a single command.

In PoDoFo from version 1.0.0 to 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. Additionally, validation of hival uses an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range.

In Vvveb prior to 1.0.8.5, getThemeFolder() returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root.

In Vvveb CMS from 1.0.0 to 1.0.8.5, saveGlobalElements() concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory, enabling path traversal. An authenticated user with the default Editor role can write arbitrary PHP content outside the theme directory, allowing persistent webshell placement.

In MythicalDash 3.5.4-aurora and earlier, the GET /api/stripe/processed endpoint accepts a payment code without constructing a Stripe Session, checking ownership, or verifying payment status. An authenticated user can abandon payment and submit the pending code to receive free virtual currency.

In AI Agent Automation prior to 0.9.1, the executeStep file-step implementation passes the user-controlled step.path value through path.resolve without verifying it remains in an approved workflow directory. An authenticated user can use traversal segments to read or write files outside the intended workspace.

In AI Agent Automation prior to 0.9.1, listMemories, deleteMemory, and clearAgentMemory use caller-supplied identifiers without verifying record ownership. An authenticated attacker who knows a victim's identifiers can read, delete, or clear the victim's agent memory data.

In Vvveb prior to 1.0.8.5, the oEmbedProxy() handler accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() only checks the hostname string, not its resolved addresses. An authenticated admin-panel user can trigger requests to private, loopback, link-local, or reserved addresses.

In Vvveb prior to 1.0.8.5, sanitizeHTML() has a flawed on* event-handler regex and a faulty loop condition, so forbidden nested tags are removed only once. A user with Author role or higher can store malicious JavaScript in the bio field that executes for other users.

In Frappe Learning Management System (LMS) prior to 2.52.1, SCORMRenderer.render in lms/page_renderers.py constructs and opens a server-side path without confirming its real path remains within public/scorm. A remote attacker can read files outside the SCORM directory.

In SQLBot prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration, which is stored without safe identifier handling. When the datasource is deleted, the value is interpolated into SQL and executed by PostgreSQL, enabling second-order SQL injection.

SQLBot before version 1.9.0 contains a vulnerability in the POST /api/v1/datasource/previewData endpoint, where the client-controlled table_name value is incorporated into generated SQL without safe identifier handling. An authenticated user can configure a datasource for the internal PostgreSQL and submit a crafted table_name that remains a SELECT operation but invokes pg_read_file(), pg_read_binary_file(), or pg_ls_dir(). In the default trusted loopback authentication configuration, the internal connection accepts invalid credentials and executes with PostgreSQL superuser privileges, allowing filesystem content such as /etc/hosts and /etc/passwd to be returned in the previewData API response, potentially exposing configuration, credentials, authentication secrets, and source code. This issue is fixed in version 1.9.0.

SQLBot before version 1.9.0 allows an authenticated user to submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content. SQLBot later serves the file inline from the same application origin through GET /api/v1/system/assistant/picture/{filename}. When another user loads that generated resource, JavaScript embedded in the SVG executes in the SQLBot web application context, resulting in stored cross-site scripting with access to data and actions available to the victim's session. This issue is fixed in version 1.9.0.