CVE Vulnerability Catalog

FOSSBilling versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability. An attacker can mark any unpaid invoice as paid and credit the client account by sending a single crafted HTTP request to the IPN callback endpoint.

Coolify prior to version 4.0.0-beta.469 contains an authenticated remote command injection vulnerability in application deployment handling. An authenticated user with application write permissions can exploit fields like dockerfile_location and deployment commands to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs.

A hidden backdoor authentication mechanism was discovered in the /bin/httpd binary within the login() function at address 004c88b8. After normal MD5/hash-based authentication fails, the system reads a backdoor password from the device configuration (sys.rzadmin.password) and compares it in plaintext using strcmp(). A match grants admin-level access (role=2) regardless of the username.

Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks.

ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can send crafted path parameters, allowing overwriting sensitive files on the system. Exploitation can lead to full administrative access to ArcGIS Server, with high impact on confidentiality, integrity, and availability.

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by improper input validation, potentially leading to remote arbitrary code execution in the context of the current user. Exploitation does not require user interaction and the scope is changed.

A high-severity vulnerability was found in the web application component of BeyondTrust Remote Support and Privileged Remote Access related to input parameter processing. Insufficient input validation may allow an authenticated attacker with limited privileges to access unauthorized resources or data beyond their scope.

A critical pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

An authentication bypass vulnerability in the default SFTP server used across Ciena products allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow reading or modifying system files.

An SSRF vulnerability in Anti-Virus for ownCloud before version 1.2.3 (and ownCloud 10 before 10.15.3) allows an attacker to send requests from the server to internal network resources. The flaw is due to insufficient URL validation in the antivirus component.

In ownCloud Core prior to version 10.15.3, the Updater exposes a dangerous method or function. This allows attackers with administrative privileges to execute arbitrary code on the server.

An authenticated user can manipulate a company ID parameter in a POST request to the backend to gain unauthorized access to other companies hosted within the same subdomain environment. The application does not adequately verify whether the requested company ID belongs to the authenticated user's session, resulting in a cross-tenant authorization bypass.

The Apache Camel AWS SNS component lacks an inbound filter rule in the Sns2HeaderFilterStrategy. However, the vulnerability is not exploitable because the component is producer-only (does not support consumers), so an attacker cannot supply external message attributes to the Camel Exchange. A defense-in-depth filter was added for consistency with other strategies.

A vulnerability in the camel-keycloak component of Apache Camel allows bypassing access token verification in the default configuration. When required roles or permissions are empty, the token is not cryptographically verified, allowing access to protected routes with any Authorization header.

A vulnerability in the Apache Camel DNS component allows SSRF attacks via improper input validation of message headers. An attacker can set dns.server, dns.name, and dns.domain headers in an HTTP request, redirecting DNS queries to a controlled server and disclosing internal hostnames.

Vulnerability in Apache Camel's mongodb-gridfs component allows an attacker to manipulate GridFS operations via HTTP headers. Improper input validation and access control enable unauthorized file deletion, reading, enumeration, and NoSQL operator injection.

Vulnerability in Apache Camel Solr component allows SSRF and injection of Solr parameters and fields. Exchange headers with SolrParam. and SolrField. prefixes are passed unfiltered from HTTP requests to the Solr producer, enabling attackers to manipulate queries and indexed documents.

Vulnerability in Apache Camel AWS2-SQS component allows attackers to inject Camel control headers (e.g., CamelHttpUri, CamelFileName) via SQS messages. Missing inbound filtering in Sqs2HeaderFilterStrategy enables modification of downstream producer behavior in the route.

The camel-keycloak component in Apache Camel lacks validation of the access token's validity window. The helper function does not check whether the token is expired or not yet valid, accepting tokens outside their intended lifetime.