CVE Vulnerability Catalog

phpMyFAQ before version 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering. This allows unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint.

phpMyFAQ before version 4.1.2 contains a SQL injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims.

In Vvveb CMS prior to version 1.0.8.3, there is an SQL injection issue in the user order history page. An authenticated user can exploit URL parameters to manipulate SQL queries.

Vvveb CMS prior to version 1.0.8.2 does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer was accepted by the server, leading to negative values in order calculations.

PHP Timeclock version 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php. This allows unauthenticated attackers to extract database contents.

Schlix CMS version 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application.

The WordPress Plugin WPGraphQL version 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloads, triggering server out-of-memory conditions and MySQL connection errors.

Trog::TOTP versions before 1.006 for Perl generate secrets using the rand function, which is predictable and unsuitable for security usage.

radare2 version 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function. This allows remote attackers to trigger memory corruption by sending a valid qfThreadInfo response followed by a malformed qsThreadInfo response.

In versions from 0.5.4 to 0.12.4, the Microsoft APM dependency manager has a vulnerability that allows enumeration of package files and reading their content through unsafe calls to Path.glob() and Path.rglob(). Symbolic links in remote APM dependencies may be improperly processed, potentially leading to the exposure of sensitive data.

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to version 1.0.233, the lack of escaping control characters from file paths when dragging and dropping a file allowed for code execution.

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to version 1.0.232, Tabby's terminal linkifier passed detected URIs directly to the operating system's protocol handler without validating the protocol scheme, allowing malicious SSH or Telnet servers to send crafted terminal output containing dangerous URIs.

In Tabby prior to 1.0.233, the application automatically confirms ZMODEM protocol detection on terminal session output and injects a fixed ZRINIT response into the PTY. When a user displays a malicious file (e.g., via `cat`), the injected bytes are interpreted by the shell as a command, leading to code execution without user interaction.

Tabby (formerly Terminus) is a highly configurable terminal emulator that prior to version 1.0.233 registered itself as the handler for the tabby:// URL scheme. This handler supports a run command that executes OS commands without user confirmation, allowing an attacker to perform remote code execution.

The bitcoinj library, a Java implementation of the Bitcoin protocol, contains verification bugs in the ScriptExecution.correctlySpends() method prior to version 0.17.1. These bugs allow an attacker to use any keypair to satisfy bitcoinj's local verification for standard P2PKH and P2WPKH spends.

Microsoft APM prior to version 0.8.12 has a vulnerability that allows malicious plugins to copy arbitrary files or directories from the installer's machine. The manifest fields agents, skills, commands, and hooks are attacker-controlled, enabling the use of absolute paths or ../ for exploitation.

The Turborepo LSP VS Code extension prior to version 2.9.14000 could execute shell commands based on workspace-controlled values. A malicious workspace could provide crafted values that were interpolated into shell commands.

Apache Flink versions 1.15.0 through 1.20.x and 2.0.0 through 2.x have a code injection vulnerability in SQL code generation. Authenticated users with query submission privileges can execute arbitrary code on TaskManagers via maliciously crafted SQL queries.

Oinone Pamirs version 7.0.0 contains a command injection vulnerability in the CommandHelper.executeCommands method. This method starts a shell process and writes attacker-controlled command strings directly to the process standard input without sanitization.