CVE Vulnerability Catalog

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation).

Public-only repository tokens can update private PR head branches.

The team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. This means a user without proper permissions can change repository-team assignments.

Theft of the Remember-Me token in Gitea does not invalidate the attacker's session, allowing continued unauthorized access.

The vulnerability allows privilege escalation via access token scope escalation in the API.

A public-only scope token can bypass restrictions on limited-visibility owners (Repository and Package categories) — residual after CVE-2026-25714 / PR #37118.

The OIDC userinfo endpoint returns identity claims without enforcing API token scopes.

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template. An attacker can submit crafted markup causing an unhandled exception or excessive memory allocation.

Vulnerability in HTML::FormHandler before version 0.410000 for Perl allows attacker-selected method dispatch and resource exhaustion. This occurs because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template, potentially leading to dangerous method calls or memory allocation.

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build added a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

The rsync daemon before version 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

The Nokri plugin versions up to 1.6.6 contain an unauthenticated Broken Access Control vulnerability. This means an attacker without logging in can access functions or data that should be protected.

The Church Admin plugin versions up to 5.1.1 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

The Everest Backup plugin versions up to 2.3.12 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

The Cartify plugin versions up to 1.3.0.1 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.

The RealPress plugin versions up to 1.1.2 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

The Salon booking system plugin versions up to 10.30.26 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.

The If-So Dynamic Content Personalization plugin versions up to 1.10 contain a Subscriber SQL Injection vulnerability. An attacker with a subscriber account can send specially crafted queries that can manipulate the database.