CVE Vulnerability Catalog

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.

The BetterLinks plugin for WordPress up to version 3.1.0 has an authorization bypass vulnerability, allowing authenticated attackers with subscriber-level access to create arbitrary short URLs with controlled slugs and redirect destinations. Exploitation requires the Fluent Boards plugin to be active and the nonce to be accessible on frontend pages.

Adminer versions 4.6.0-5.5.0 (fixed in 5.5.1) have an incomplete fix for an X-Forwarded-Prefix vulnerability. The validation only rejects prefixes starting with '/', but allows values like '/\evil.com' which, after browser normalization, become a network-path reference affecting the Set-Cookie Path attribute.

The Events Manager plugin for WordPress up to version 7.4.0 is vulnerable to SQL injection via the 'meta_key' parameter in the event/location duplicate action. Attackers with contributor-level access can append additional SQL queries to extract sensitive information from the database.

The WP Courses LMS plugin for WordPress up to version 3.2.29 has an Insecure Direct Object Reference vulnerability via the 'resultID' parameter. Authenticated attackers with custom-level access can read other users' quiz answers and scores by enumerating resultID values.

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

OpenEXR versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13 have an integer overflow in unpack_sample_table(), leading to a read from an invalid memory address and crash when decoding a crafted deep tiled EXR file.

OpenEXR before versions 3.2.10, 3.3.12, and 3.4.13 has an infinite-loop vulnerability in roundListSizeUp() in SampleCountChannel. Supplying UINT_MAX causes the loop to never exit, leading to application hang (denial of service).

OpenEXR versions 3.4.0-3.4.12 have a NULL pointer dereference in exr_attr_set_bytes(). Supplying a positive hint_length with a NULL type_hint causes a deterministic crash, leading to denial of service.

OpenEXR before versions 3.2.10, 3.3.12, and 3.4.13 has a heap out-of-bounds write in SampleCountChannel::set(). An error in Y coordinate calculation can lead to writes before the buffer, potentially causing memory corruption and crashes.

OpenEXR versions 3.4.0-3.4.12 have a reachable assertion failure in the HTJ2K decode path, allowing a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service.

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a crafted HTJ2K-compressed EXR file causes an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.

Faveo Helpdesk up to version 2.0.3 contains a path traversal vulnerability in the unlink function of SettingsController.php (Logo Handler component). Manipulation of the data1 argument allows remote file deletion. The exploit has been publicly disclosed and may be used.

Faveo Helpdesk up to 2.0.3 has a missing authentication flaw in the post-ticket-reply endpoint (FormController::post_ticket_reply). The attack can be initiated remotely, and the exploit has been published. The project was informed but has not responded.

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.