CVE Vulnerability Catalog

In the display module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation if an attacker has already obtained System privilege. User interaction is not required for exploitation.

Wtyczka Download Manager dla WordPressa jest podatna na eskalację uprawnień poprzez przejęcie konta we wszystkich wersjach do 3.3.40 włącznie. Problem wynika z niewłaściwej weryfikacji tożsamości użytkownika przed aktualizacją jego danych, takich jak hasło.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have an infinite loop in the CalcProfileID function in IccProfile.cpp. This issue is fixed in version 2.3.1.1.

W projekcie Online Music Site w wersji 1.0 znaleziono lukę, która dotyczy nieznanej części pliku /Administrator/PHP/AdminViewSongs.php. Manipulacja argumentem ID może prowadzić do wstrzyknięcia SQL.

AIOHTTP, an asynchronous HTTP framework for asyncio and Python, versions 3.13.2 and below allow a crafted request to cause uncontrolled memory consumption on the server. If an application uses the Request.post() method in a handler, an attacker may freeze the server by exhausting memory. This issue is fixed in version 3.13.3.

AIOHTTP versions 3.13.2 and below contain a vulnerability that allows an infinite loop to occur when assert statements are bypassed, resulting in a DoS attack when processing a POST body. If optimizations are enabled (-O or PYTHONOPTIMIZE=1) and the application includes a handler using Request.post(), an attacker may execute a DoS attack with a specially crafted message. This issue is fixed in version 3.13.3.

Wykryto podatność w systemie Online Music Site w wersji 1.0, która dotyczy nieznanej funkcjonalności pliku /FrontEnd/Albums.php. Manipulacja argumentem ID prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

A vulnerability in AIOHTTP versions 3.13.2 and below allows a zip bomb attack that, upon decompression, can exhaust host memory and cause a DoS.

Frappe, a full-stack web application framework, is vulnerable to path traversal attacks in versions 14.99.5 and below, and 15.0.0 through 15.80.1. Lack of proper sanitization on some requests allows arbitrary files to be retrieved from the server. This issue is fixed in versions 14.99.6 and 15.88.1.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via a maliciously attached Behavior. The attack requires administrator access to the Craft Control Panel.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via Twig SSTI. The vulnerability requires administrator access to the Control Panel with allowAdminChanges enabled, or a non-admin account with access to the System Messages utility. A malicious payload using the Twig `map` filter in Twig-accepting text fields can lead to RCE.

The jsPDF library prior to version 4.0.0 is vulnerable to local file inclusion and path traversal. An attacker can exploit the loadFile method, as well as addImage, html, and addFont, to read arbitrary files from the server's file system. The file contents are then embedded in generated PDF documents.

W wersjach przed 6.1.1 biblioteka vega-functions, która implementuje funkcje dla języka wyrażeń Vega, pozwalała na wykorzystanie złośliwego kodu JavaScript (XSS) poprzez wewnętrzną funkcję, która nie jest częścią publicznego API. Problem został naprawiony w wersji 6.1.1.

A vulnerability in Vega library before versions 6.1.2 and 5.6.3 allows arbitrary JavaScript execution (DOM XSS) in applications that expose Vega and View objects globally and allow user-defined Vega specifications. The attack requires user interaction, such as opening a malicious specification.

Spinnaker, jako platforma do ciągłego dostarczania, jest podatny na atak typu server-side request forgery w wersjach przed 2025.1.6, 2025.2.3 i 2025.3.0. Atak ten umożliwia użytkownikom pobieranie danych z zdalnych adresów URL, które mogą być następnie wstrzykiwane do potoków Spinnakera.

A ReDoS vulnerability in Anthropic's MCP TypeScript SDK up to version 1.25.1 exists in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on specially crafted inputs, leading to excessive CPU consumption.

Wykryto podatność bezpieczeństwa w projekcie Online Music Site w wersji 1.0. Problem dotyczy pliku /login.php, gdzie manipulacja argumentami username/password prowadzi do wstrzykiwania SQL.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim and modify the Host header to a malicious value. The victim receives a password reset email with a link to the malicious host, and if clicked, the reset token is sent to the attacker's server, allowing account takeover.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, a low-privileged user (member) can view and use invitation links sent to an administrator. If they use the link before the legitimate recipient, they can log in as an administrator, resulting in privilege escalation.