CVE Vulnerability Catalog

LibreChat contains an authorization bypass vulnerability due to improper access control checks. The checkAccess function uses permissions.some(), granting access when only one of multiple required permissions is present — a USER role can create agents despite lacking CREATE permission.

A vulnerability was identified in Campcodes Society Membership Information System 1.0. The file /check_student.php is affected; manipulation of the student_id argument leads to SQL injection. The attack may be performed remotely and the exploit is publicly available.

A vulnerability in Portabilis i-Educar up to 2.10 affects unknown code in the file /module/ComponenteCurricular/edit. Manipulation of the argument ID causes SQL injection. The attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of the argument ID results in SQL injection. The attack can be executed remotely. The exploit has been made public and could be used.

A vulnerability was found in Portabilis i-Educar up to 2.10. The file /module/Cadastro/aluno is affected; manipulation of the argument is leads to SQL injection. Remote exploitation is possible and the exploit has been disclosed.

The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during installation. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files executed with SYSTEM privileges. No patch is available as the vendor has been unresponsive.

In the Linux kernel tracing/osnoise, osnoise_cpus_write() does not validate the count parameter. When a user writes zero bytes, kmalloc() returns ZERO_SIZE_PTR, which cpulist_parse() treats as a valid pointer, triggering a NULL pointer dereference in bitmap_parselist().

A vulnerability was fixed in the Linux kernel BPF subsystem where calling bpf_timer_init() from a context already holding a lock (e.g., rq_lock) could lead to double-acquiring the same lock and a hardlockup. The issue arose because the memory allocation path in __bpf_async_init() could trigger a MEMCG_MAX event and cgroup_file_notify(), which attempted to reacquire the same lock. The fix uses __GFP_HIGH instead of GFP_ATOMIC to avoid spinning in that path.

A vulnerability in the Linux kernel's OCFS2 filesystem causes a recursive semaphore deadlock during a FIEMAP call. The ocfs2_fiemap() function takes a read lock on ip_alloc_sem and then calls fiemap_fill_next_extent(), which can trigger a page fault and invoke ocfs2_page_mkwrite() attempting to take a write lock on the same semaphore, leading to a filesystem hang.

A race condition between inode eviction and caching in the Linux kernel's btrfs filesystem can leave a live inode missing from the root's xarray. This causes subvolume deletion to hang in an infinite loop, resulting in soft lockups. The fix ensures the xarray entry is only deleted if it still matches the inode.

In the Linux kernel, the ceph module fails to call ceph_shift_unused_folios_left() in certain code paths, leaving illegal NULL entries in folio_batch. This can lead to a kernel crash (NULL pointer dereference) during page write operations. The issue is fixed by ensuring the function is always called after ceph_process_folio_batch().

In the Linux kernel Ceph, move_dirty_folio_in_page_array() always returns 0 because it NULLs the pointer before returning PTR_ERR(NULL). Errors from fscrypt_encrypt_pagecache_blocks() are silently ignored, leaving NULL entries in the page array that may later crash the kernel.

W jądrze Linuxa naprawiono podatność związaną z funkcją fec_enet_phy_reset_after_clk_enable(). Funkcja of_phy_find_device może zwrócić NULL, co wymaga ostrożności przed dereferencją phy_dev.

In the Linux kernel, the igb driver causes a NULL pointer dereference during the ethtool loopback test because the test ring has no associated q_vector (interrupts are not added to test rings). The fix leverages the fact that since commit 5ef44b3cb43b there is no need to pass a napi_id to __xdp_rxq_info_reg() and uses 0 as the last parameter.

A deadlock occurs in the Linux kernel's macsec implementation when updating network interface features via ETHTOOL_SFEATURES. When lower device (real_dev) features are out of sync with the upper macsec device, netdev_sync_lower_features attempts to re-lock the same device, causing a hang. The fix ensures lower device features are synchronized when the macsec link is created.

A SQL injection vulnerability was identified in SourceCodester Pet Grooming Management Software 1.0 in the file /admin/print-payment.php. Manipulation of the argument sql111 allows remote attack initiation. The exploit has been made public and could be exploited.

A SQL injection vulnerability was found in SourceCodester Pet Grooming Management Software 1.0 in the file /admin/inv-print.php. Manipulation of the argument ID allows remote attack. The exploit has been released to the public and may be exploited.

The Widget Options - Extended plugin for WordPress up to version 5.2.1 is vulnerable to Stored Cross-Site Scripting via the 'do_sidebar' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user visits an affected page.

A security flaw was discovered in SourceCodester Pet Grooming Management Software 1.0. The file /admin/view_payorder.php is affected; manipulation of the ID argument results in SQL injection. The attack can be initiated remotely and the exploit has been released.

The Request a Quote plugin for WordPress (from emarket-design) contains a Stored XSS vulnerability in versions up to and including 2.5.0. Improper neutralization of input during web page generation allows persistent script injection.