CVE Vulnerability Catalog

Yshopmall through 2.0.0 contains an insecure direct object reference (IDOR) vulnerability in the member address API. Authenticated members can read, overwrite, and delete other members' shipping addresses by enumerating sequential address IDs via /address/detail/{id}, /address/del, and /address/edit.

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler. Unauthenticated attackers can read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters, retrieving files like application.yml and exposing database, Redis, and Nacos credentials.

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.

Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and substitute a malicious archive, which runs as the gitstatusd daemon under the user's account on every prompt.

Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator.

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected is the function PDO::prepare of the file login/index.php. Manipulation of the username/password argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly and may be used.

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the Login Endpoint component. Manipulation of the username/pass argument causes SQL injection. The attack can be initiated remotely, and the exploit has been published and may be used.

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the Account Creation component. Manipulation of the Name argument results in SQL injection. The attack may be performed remotely, and the exploit is now public and may be used.

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify trusted site.

A vulnerability in the Dio library for Dart and Flutter affects the HTTP/2 adapter, which during redirects copies original request headers, including Authorization, Cookie, and Proxy-Authorization, to a request to a different domain. A server can return a redirect to a malicious domain that receives these sensitive headers. The issue affects versions from 1.0.0 to 2.8.0 and is fixed in version 2.8.0.

The vulnerability in Xen concerns issues with grant table operations, where v2 -> v1 -> v2 changes can lead to changes in the addresses of status pages. Previously calculated pointers into the status array may become stale, potentially leading to incorrect behavior.

The vulnerability in Xen concerns the XPTI (Xen Page Table Isolation) mechanism, which copies PV guest page table entries from guest-chosen root page tables to the Xen-chosen one. PV guests may have a directmap that does not cover all memory, especially when memory extends beyond the 5 TiB (or 3.5 TiB with CONFIG_BIGMEM=y) address boundary.

A vulnerability in Heym before version 0.0.40 allows an authenticated user who can create or edit a workflow with a custom Python tool to bypass the blacklist-based sandbox. Standard Python libraries expose system functions that pass validation, and the tool is executed via exec(), enabling command execution and file operations as the backend application user. The issue is fixed in version 0.0.40.

A vulnerability in slackero phpwcms up to version 1.9.49/1.12.3 involves unrestricted file upload in the Extension Check component, in the file include/inc_front/content/cnt23.article.inc.php, via manipulation of the POST_name argument. The attack can be performed remotely. Fixes are available in versions 1.9.50 and 1.12.4.

A vulnerability in SourceCodester Simple Cafe Billing System 1.0 affects the Action::save_user function in the file admin_class.php, in the User Management component. Manipulation of the Type argument leads to improper authorization. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability in girishsaraf Online-Appointment-Booking-System up to version f427b4757128ca253d33d0cc4e87bbb9c999a4d5 involves missing authorization in the file changebookingstatus.php, in the submit2 Handler component. Manipulation of the username[]/timestamp[]/status[] arguments leads to missing authorization. The attack can be performed remotely, and the exploit is publicly available. The vendor has not responded.

A vulnerability in Plane before version 1.4.0 involves failure to sanitize unsafe URL schemes in comments (comment_html). A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser of another user who clicks the link. The issue is fixed in version 1.4.0.

The vulnerability in Xen concerns the GNTTABOP_cache_flush operation, which may be issued on memory mapped from another domain using the grant table interface. There was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory.