CVE Vulnerability Catalog

In backpack/crud before 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest builds a shell command with a URL influenced by the HTTP Host header and passes it to exec() without adequate shell neutralization. An unauthenticated attacker can inject OS commands when exec() and curl are available and the 1-in-100 random gate is reached (repeated requests can hit it). Successful exploitation executes commands as the web-server user.

From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branches controlled by $column['escaped'], which defaults to true, causing $column['text'] to be rendered unescaped by default. An attacker who can store an unsanitized value in a color column can execute script in the browser of a user who views the CRUD list, including an administrator.

In backpack/crud from 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes.

In backpack/crud before 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator can delete another record's attachment, a shared asset, or another operational file on the configured disk.

From 6.0.0 until 6.8.14 and 7.0.38, HasUploadFields methods uploadFileToDisk and uploadMultipleFilesToDisk, used through CrudTrait, and the withFiles() path through FileNameGenerator do not internally reject server-executable file types. An authenticated administrator can achieve remote code execution by using an upload-enabled CRUD field without mimes: and mimetypes: validation when the public disk is web-accessible.

From 6.0.0 until 6.8.14 and 7.0.38, MyAccountController::postAccountInfoForm at POST /admin/edit-account-info permits AccountInfoRequest to update backpack_authentication_column(), which is email by default, without requiring current_password or otherwise verifying the account's existing password. An attacker with a temporary authenticated Backpack session can change the account-recovery email and later use the password-reset flow.

In backpack/crud before 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can mass-assign password, the authentication column, or other deployment-specific fillable attributes.

Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote() treats any value without an HTTP or HTTPS prefix as a local path. src/request-handler.ts passes that value through getAssetPath() to loadAsset(), which appends a JSON suffix and uses fs.readFile without canonicalizing the path or verifying that it remains inside the configured video folder.

In EasyAdmin from 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin.

In docx4j before 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError.

In http4k before 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap.

Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled.

In dd-trace-rb before 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192), although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

In dd-trace-java before 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192), although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data.

October CMS versions prior to 3.7.17 and 4.2.21 contain a PHP object injection vulnerability in the system module. The backend `SessionMaker` trait stored widget session state as `base64(serialize(...))` and consumed it with `unserialize()` without an `allowed_classes` restriction, allowing attacker-controlled bytes to trigger object injection and reachable PHP gadget chains. This issue only affects installations with `cms.safe_mode` enabled, which is an opt-in feature for demo or multi-tenant scenarios.

In Conform from 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service.

Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime. Special characters can turn the expected path suffix into query data or introduce slash and dot segments that traverse paths.

A vulnerability in the October CMS system module's Twig sandbox security policy allowed a chained bypass when cms.safe_mode is enabled. By combining unrestricted access to the Laravel session store with unblocked raw SQL methods reachable through Eloquent's __call forwarding, a backend user with CMS markup editing access could read arbitrary database values and write to the backend authentication session key, forging a session as another existing user. The issue is patched in versions 3.7.17 and 4.2.21.

fluent-plugin-s3 from 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3 bucket can provide a highly compressed object that expands excessively.