CVE Vulnerability Catalog

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. This affects a wide range of Spring Framework versions.

The device metadata import interface /device/instance/{productId}/property-metadata/import in jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these four paths, so any anonymous attacker can read every configuration item and configuration file managed by the config center.

Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.

Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} in super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.

KubePi versions up to and including 1.6.15 expose SSO configuration API endpoints on the same public routing boundary as SSO login and callback endpoints, allowing SSO, OIDC, and SAML management without administrator authorization. Unauthorized users can inspect or alter authentication configuration, potentially leading to account takeover or privilege escalation. The SSO connectivity-test function can be abused as SSRF, and the user list API returns user objects without clearing authentication-related fields. Fixed in version 2.0.0.

The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.

Improper neutralization of special elements in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.

A zero-click remote code execution vulnerability in SimpleX Chat before v6.5 in the /Terminal/Notification.hs component allows attackers to execute arbitrary commands in the context of the application without user interaction by sending a crafted payload in a text message.

A vulnerability in openRISC OR1200 (commit 83ac6b) is due to a mismatch between the RTL and netlist, which can lead to unexpected behavior.

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_resource table through the ReportController.save() interface and directly embedded into Hibernate native queries without any parameterization or filtering.

In DocSys-master V2.02.85, the uploadMarkdownPic interface in DocController.java has an arbitrary file upload vulnerability.

The /cms/category/list interface in MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause via FreeMarker ${size} without parameterization. The SqlInjectionUtil filter does not block keywords like CREATE/TABLE/SET/PREPARE/EXECUTE, allowing bypass and execution of stacked SQL statements without login.

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default.

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.