CVE Vulnerability Catalog

YesWiki from version 4.2.0 to before 4.6.6 has a SQL injection vulnerability in ApiController::deletePage(), where a page tag retrieved from the database is interpolated into a DELETE query without escaping. A low-privilege authenticated user can create a page with a tag that is a SQL fragment and execute arbitrary SQL in the wiki database.

YesWiki prior to version 4.6.6 has an unauthenticated SQL injection vulnerability in public Bazar entry-listing APIs, in numeric query filters. The filter value is escaped but inserted into SQL without quotes or numeric validation, allowing an attacker to inject boolean expressions and infer database contents.

YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in the POST /api/forms/{formId}/actor/inbox route, which is publicly exposed. HttpSignatureService::verifySignature() parses the HTTP Signature header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification. An unauthenticated attacker can make the server issue requests to internal services, including cloud metadata.

YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in HttpSignatureService::verifySignature(), which checks the result of openssl_verify() with a loose boolean negation. Since PHP treats -1 as truthy, the condition !(-1) is false, causing the error to be skipped and processing to continue even when signature verification failed.

YesWiki prior to version 4.6.6 has a vulnerability in the {{erasespamedcomments}} wiki action that deletes arbitrary wiki pages without authorization based on a suppr[] array from POST. The default ACL model allows any user with write access to delete pages, including the front page and admin pages.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page.

YesWiki prior to version 4.6.6 contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template field, which are executed server-side when public semantic endpoints are requested.

ntop nDPI before version 6.0 has a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger it with crafted network packets containing TLS SNI, HTTP headers, or DNS names, causing heap corruption.

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.

PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task spawning and object deletion. Attackers can trigger the calibration process via shell commands to write to freed heap memory, corrupting unrelated objects or allocator metadata and destabilizing heap operations.

Unidata netcdf-c through 4.10.1 has an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Crafted HDF5 files with oversized attribute names can overflow the buffer, causing memory corruption and crashes.

Laravel before versions 12.60.0 and 13.10.0 has a CRLF injection vulnerability in email validation, which combined with Symfony Mailer and Symfony Mime handling of certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing. Patched in 12.60.0 and 13.10.0.

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions.

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents.

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

Twig from version 1.0.0 to before 3.27.0 has a vulnerability in SecurityPolicy::checkMethodAllowed() that unconditionally whitelists all method calls on instances of Twig\Markup. Since Twig\Markup is not final, subclasses inherit the bypass. An application passing an object of a Markup-derived class into a sandboxed template inadvertently exposes every public method of that subclass to template authors. Patched in 3.27.0.

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content submitted when an authenticated user interacts with the MCP server.