CVE Vulnerability Catalog

Pimcore prior to versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in the class-definition import endpoint where a DataObject field name is emitted without an identifier allowlist, allowing an authenticated user with objects permission to inject PHP syntax into generated DataObject classes and inject SQL identifier content into schema-changing statements. The setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters.

Yamcs prior to versions 5.12.8 and 5.13.2 has a vulnerability in LikeExpression.fillCode_getValueReturn where a LIKE pattern is not properly escaped and is inserted into Java source compiled by SimpleCompiler.cook. The pattern can originate from various API endpoints, and a quote in the pattern can inject Java that runs as the Yamcs server process.

Yamcs prior to versions 5.12.8 and 5.13.2 inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Successful exploitation executes commands as the Yamcs service account.

Yamcs before versions 5.12.8 and 5.13.2 allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source. Via the POST /api/archive/{instance}:executeSql endpoint, arbitrary Java code can be executed in the Yamcs server process, potentially exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

JS Recon from 1.2.1-beta.1 to 1.3.1-beta.2 has a vulnerability in the PR Branch Checker workflow where github.head_ref and github.event.pull_request.head.repo.full_name are interpolated into a shell gh pr comment command. A remote user opening a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.

plone.app.portlets before versions 5.0.8, 6.0.4, and 7.0.2 allows a member who can add an RSS portlet to set its feed URL to a very large response, causing excessive data retention in memory and denial of service. The RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, enabling server-side requests to internal services. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

plone.app.event before versions 5.2.4 and 6.0.1 has a vulnerability in the iCalendar import that accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources, and store a malicious event URL that executes script in another user's browser. This issue is fixed in versions 5.2.4 and 6.0.1.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in Hotspotimage::getDataFromResource() that passes the __hotspots column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with the ability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods, potentially leading to arbitrary file writes or code execution. This issue is fixed for Hotspotimage in versions 11.5.19, 12.3.10, and 2026.1.6.

free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.

Klever-Go before version 1.7.19 has a vulnerability in decoding split-royalty fields that can contain values greater than core.HundredPercent, and summing in uint32 accumulators can wrap the validation sum to zero and bypass checks. Royalty payout paths credit each oversized split amount and silently discard a negative remainder, allowing ordinary transfers to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.

Klever-Go before version 1.7.19 has a vulnerability in marketplace settlement where it reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing more currency to be credited than paid. This issue is fixed in version 1.7.19.

Kubeflow Pipelines before version 2.17.0 has an unauthenticated SSRF vulnerability in the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route is accessible without authorization, allowing requests to be forwarded to internal services and responses returned to the attacker. This issue is fixed in version 2.17.0.

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getParentalRules function of TOTOLINK T6 allows unauthenticated attackers to obtain parental-control rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getPasswordCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain the administrative username via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getNtpCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain NTP configuration and current time data via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 allows unauthenticated attackers to obtain Wi-Fi ACL rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 allows unauthenticated attackers to generate and retrieve a new WPS PIN via a crafted POST request to /cgi-bin/cstecgi.cgi.