CVE Vulnerability Catalog

WWBN AVideo in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName() and Category::setIconClass(), which store the values without sanitization, and they are later echoed as HTML in views and gallery cards.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations.

Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route and its controls (Enterprise plan requirement, SSO provider creation via Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth). The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which reports {"has_sso": true, "enforce_sso": true} for domains that were never verified.

The npm package `capgo` (through version 12.207.1) fails to compare the caller's role rank against the requested role in validateInvite(). A user holding only the org.invite_user permission can invite an external user as org_admin or org_billing_admin, and accepting the invitation creates the role binding while bypassing database protection triggers.

The Capgo backend (through 12.242.4) does not validate parent-child delegation when processing the x-limited-key-id header. The middleware trusts the attacker-supplied key ID and can substitute the identity and secret of a more privileged key owned by the same user.

Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions. The Edge authorization path accepts a password-only Supabase aal1 session and grants RBAC permissions even when the account has a verified MFA factor that was not used for the session.

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the File Preview Service component. Manipulation of the file_path argument leads to path traversal. Local access is required to approach this attack, and the exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 addresses this issue (patch b7bf78ab74b1552c92fc98c7db9a8a8d92c631df).

A maliciously crafted add-in installed and executed in Autodesk Fusion Desktop can modify persistent network proxy settings without user notification or consent. A successful exploit may redirect authenticated Fusion network traffic through an attacker-controlled proxy.

ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability. An unauthenticated remote attacker can crash the ION process by sending a BPv7 bundle with a zero-length payload, causing a failed CHKZERO assertion and process termination with SIGABRT.

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF from 2.01.0.2183 before 18.9.26.2319.

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations. Authenticated users can relocate files from outside the document root, disclosing file contents and deleting originals.

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php. Authenticated users can inject OS commands through directory names and execute arbitrary commands as the web-server user.

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() function compares realpath() to boolean true, which never succeeds.

Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded.

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. The flaw allows an attacker to manipulate database queries.

LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.

LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.

A path traversal vulnerability exists in GIS Informatics GisLab Laboratory Management System due to improper limitation of a pathname to a restricted directory. The issue affects versions from 1.4.03 before 1.5.