CVE Vulnerability Catalog

In MSI Dragon Center up to version 2.0.155.0, an integer overflow vulnerability was found in the MmioWritePath function in the NTIOLib_X64.sys library. The attack requires local access, and the exploit has been made public.

A flaw has been found in sdcb chats up to version 1.12.0. It affects the DownloadPublic function in FileController.cs (Signed File Download Endpoint). Missing authentication allows remote exploitation, but the attack complexity is high and exploitability is difficult. The exploit has been published.

MapSVG versions up to 8.15.0 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can make the server send requests to arbitrary resources, including internal ones, without authentication.

pnpm before versions 10.34.5 and from 11.0.0 until 11.11.0 parses package names from attacker-controlled pnpm-lock.yaml keys without validation, which can lead to package contents being written outside node_modules during installation. If lifecycle scripts are allowed, this can enable code execution.

A potential security vulnerability has been identified in HP ImageDiags for versions prior to 5.0.0.36, which could allow a local attacker to escalate privileges due to insufficient access controls.

Unauthenticated Cross Site Scripting (XSS) vulnerability exists in WordPress Social Login and Register versions up to 7.8.2.

An unauthenticated bypass vulnerability in SiteGround Security versions up to and including 1.6.6.

An unauthenticated PHP Object Injection vulnerability was detected in Tickera versions up to 3.6.0.2. This vulnerability may allow an attacker to execute arbitrary code or perform other unauthorized actions.

An unauthenticated broken authentication vulnerability in RegistrationMagic versions up to and including 6.0.9.8.

An unauthenticated Cross Site Scripting (XSS) vulnerability in SliceWP versions up to and including 1.2.10.

An unauthenticated Cross Site Scripting (XSS) vulnerability in RegistrationMagic versions up to and including 6.0.9.8.

In EasyAdmin (an admin generator for Symfony) versions from 4.0.0 to 4.29.16 and 5.5.1, there is a vulnerability where path-based access control can be bypassed. This occurs because the controller swap happens after the firewall check, and the routeName parameter is not validated. A low-privilege user can execute another route's controller if they know its name, bypassing path-based protections. Routes that enforce their own authorization (e.g., via #[IsGranted]) remain protected. The issue is fixed in versions 4.29.16 and 5.5.1.

In elFinder (a web file manager) before version 2.1.70, there is a vulnerability that allows bypassing file type restrictions during archive extraction. The checkExtractItems() function does not normalize the MIME type, so files with extensions .phtml, .phar, .php5, and .php3 can be extracted even if uploadDeny blocks text/x-php. An attacker with ZIP upload permission can place PHP files in a web-accessible directory and achieve remote code execution. The issue is fixed in version 2.1.70.

elFinder before version 2.1.70 does not protect the netmount command against CSRF attacks because it is not included in the list of protected commands. In the default configuration, FTP network mounts are enabled, and an attacker can control parameters such as protocol, host, port, user, password, allowing persistent mounting of an attacker-chosen FTP server in the victim's session and sending credentials without a CSRF token.

In elFinder before version 2.1.70, there is a Server-Side Request Forgery (SSRF) vulnerability during URL uploads. When PHP cURL is unavailable, IP validation can be bypassed via DNS rebinding, allowing connections to internal addresses. Additionally, even when using cURL, there is a blind SSRF path. The issue is fixed in version 2.1.70.

@hono/oauth-providers before version 0.8.6 accepts an OAuth callback even when the 'state' value is absent on both sides, making the 'state'-based anti-CSRF protection ineffective. An attacker can exploit this to perform CSRF attacks on social login.

Livewire from version 3.0.0-beta.1 to 3.8.3 and 4.3.4 has a vulnerability in the dot-notated query-string parser that accepts __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers treat inherited properties as trusted effects, allowing an unauthenticated attacker to execute arbitrary JavaScript in the application's origin when a user opens a crafted URL.

An unauthenticated Arbitrary File Upload vulnerability was detected in Hash Form versions up to 1.4.2. This vulnerability may allow an attacker to upload malicious files to the server.

An improper validation of specified quantity in input vulnerability was detected in the Newspapers X theme from version 1.0.46 through 1.0.48, allowing malicious software to be implanted.

Cross Site Scripting (XSS) vulnerability in Kalles Addons up to version 1.0.6. A subscriber-level attacker can inject malicious scripts.