CVE Vulnerability Catalog

In the ramon-victor freegpt-webui project up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc, there is a race condition vulnerability in the getJailbreak function of the file server/config.py in the Jailbreak Mode component. The attack can be launched remotely but requires a high level of complexity and is assessed as difficult to exploit. The exploit has been released. The product uses a rolling release model, so version details are not available. This vulnerability only affects products that are no longer supported by the maintainer.

A flaw in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the getJailbreak function in server/backend.py of the Jailbreak Mode component. Manipulation can lead to resource allocation. The attack can be executed remotely. The exploit has been published and may be used. This product is no longer supported by the maintainer.

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. It affects the _conversation function in server/backend.py of the Backend Conversation API. Manipulation of the model argument leads to missing authentication. The attack can be launched remotely. The exploit has been publicly disclosed. This product operates on a rolling release basis, so no version details are available. This vulnerability only affects products no longer supported by the maintainer.

A vulnerability in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the ChatCompletion.create function in g4f/__init__.py of the Authentication Check component. Manipulation leads to missing authentication. The attack may be performed remotely. The exploit has been disclosed publicly and may be used. This product is no longer supported by the maintainer.

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to Cross-Site Request Forgery (CSRF). An attacker could exploit this to perform state-changing operations on the device.

In CRMEB v6.0.0, there is an arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component. An authenticated attacker can delete arbitrary files via a crafted POST request.

An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request.

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials.

An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component.

Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function.

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_<field>? policies deny the operation. This issue has been patched in version 3.32.0.

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path.

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.

Amazon ion-java before 1.12.1 improperly handles highly compressed data, potentially allowing remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936.

A flaw in code-projects Online Shopping System 1.0 affects the mysqli_query function in admin/adduser.php. Manipulation of the mobile argument can lead to SQL injection. The attack may be performed remotely. The exploit has been published and may be used.

The MQTT service in Trueview 6.0.23.4 has no authentication. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations.

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational data, including device identifiers, message metadata, and control-related information.

Trueview T18161 S 6.0.23.4 contains improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components.