CVE Vulnerability Catalog

In ITFlow prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The parameter is sanitized but interpolated unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression and expose database data.

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. The browser extensions use an all-URLs host permission to detect HWP and HWPX links, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.

FairEmail is an open source email app for Android. The ActivityAMP AMP message renderer enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. This issue is fixed in version 1.2319.

In Speakr prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() hook permanently exempts a view from CSRF protection, and is_token_authenticated() treats any present token (including from URL query) as authenticated without validation. A network attacker can disable CSRF protection and perform cross-origin attacks.

In Browsertrix from 1.15.0 until 1.22.8, improper sanitization of Git URLs specified as Custom Behaviors allows command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod.

In OpenReception prior to 1.1.1, the POST /api/auth/passkeys endpoint accepts a request-body userId and an attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and does not bind enrollment to locals.user.id. An unauthenticated attacker who knows the public tenant ID and the target staff email can inject a controlled public key, identify the matching userId, and create a STAFF session.

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim. This issue is fixed in version 8.6.4.

In MapServer prior to 8.6.4, PostGIS filter translation in msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and Integer metadata are configured, but does not verify that attacker-controlled CGI or OGC API Features input is a numeric literal. The unquoted input is concatenated into the SQL predicate, enabling SQL injection.

In Glean prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to fetch and parse without network-level validation. A malicious feed can make the server request private, loopback, link-local, or cloud-metadata resources, with the response stored and retrievable via API.

In Wavelog from 1.8 until 2.4.2, the files /install/ajax.php and /install/includes/interface_assets/triggers.php remain accessible after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile(), allowing an unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files that can execute on the server.

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users to execute arbitrary OS commands via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi.

In dd-trace-cpp prior to 2.1.0, parsing incoming W3C baggage headers does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated attacker can send a header with many key-value pairs or one very large value, causing unbounded CPU and memory consumption.

In Datadog PHP Tracer prior to 1.19.2, ddtrace_deserialize_baggage parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send many key-value pairs or one oversized value, causing unbounded CPU and memory consumption.

Metacat is data repository software for researchers. MetacatSolrIndex.query forwards the client-controlled qt parameter through Apache SolrJ from search endpoints such as /d1/mn/v2/query/solr/ to its privileged Solr backend. An unauthenticated client can select the /admin/file handler, and SolrJ reformats the parameter into a request accepted even when handleSelect=false is configured on Solr 7.0 or later. When Solr returns the selected core configuration file, Metacat embeds the raw content in an XML processing error response, disclosing internal files such as solrconfig.xml. This issue is fixed in version 3.4.2.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In OpenSlide from 3.4.1 until 4.0.1, parse_level0_xml() processes a crafted Ventana BIF file accepting nonpositive row or column tile counts. The invalid counts produce attacker-controlled memory offsets and allow arbitrary writes, resulting in a crash or potential arbitrary code execution.

In Chamilo LMS from 2.0.0 through at least 2.1.0, private Message.content is stored without server-side sanitization and rendered as HTML in MessageShow.vue and view_message.html.twig. An authenticated low-privilege user, including a student, can send crafted message content to an administrator, which executes in the recipient's browser when the inbox or message view is opened.

In Chamilo LMS prior to 2.0.1, an unauthenticated remote attacker can execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism.

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symlinks to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside it, which then runs with Grafana server privileges.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.