CVE Vulnerability Catalog

Kirby is an open-source CMS. Prior to 4.9.5 and 5.5.2, the media handler used incomplete filesystem containment checks, allowing access to files in sibling directories if the path shared a common prefix. A remote attacker could create and access thumbnails from image files in a sibling directory, potentially exposing staging sites, backups, or other internal sites.

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalation vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.

Kirby is an open-source content management system. From version 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.

Smarty is a template engine for PHP. Prior to 4.5.7 and 5.8.2, the {fetch} handling used Security::isTrustedUri() to validate only the initial remote URL, and PHP followed HTTP redirects by default. An attacker with an open redirect on a trusted host could redirect the request to an internal endpoint, bypassing the trusted_uri allowlist and performing SSRF.

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverified email (multi-tenant IdPs, IdPs with open self-registration, or any IdP the attacker partly controls), an attacker with no Wallos account can authenticate with the admin's email and be logged in as the admin — full account takeover, no password needed. This issue has been patched in version 4.9.6.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.

Wallos before version 4.9.6 contains a path traversal vulnerability in the POST /endpoints/db/restore.php endpoint. The ZipArchive::extractTo() function does not validate entry names for '../' sequences, allowing an admin to upload a crafted zip with logos/../../endpoints/shell.php to write a webshell to the webroot. The extension filter only applies to the post-extraction logo copy step, so it does not prevent this attack.

Wallos before version 4.9.6 contains an SSRF vulnerability in the POST /endpoints/notifications/testemailnotifications.php endpoint. The smtpaddress and smtpport parameters are taken from the POST body with zero SSRF validation, and PHPMailer connects to the attacker-supplied host:port. Every other notification endpoint uses ssrf_helper.php but email was missed. Any authenticated user can probe internal network and access cloud metadata.

Wallos before version 4.9.4 has an authentication bypass vulnerability in the endpoints/db/import.php endpoint. The only guard is a user-table row count – if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database.

Wallos before version 4.9.4 has a vulnerability in the OIDC mechanism. login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account.

Wallos before version 4.9.4 has an authentication bypass vulnerability in the endpoints/db/migrate.php endpoint. This endpoint executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database.

backpack/crud provides CRUD functions for Backpack, a Laravel package collection. From 6.0.0 until 6.8.14 and 7.0.37, the methods SingleBase64Image::uploadFiles and uploadRepeatableFiles accept any data URI starting with data:image without validating MIME subtype or decoded bytes. An authenticated administrator can store arbitrary file content under an extensionless filename, which can cause stored XSS or other unintended behavior.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, the endpoint currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of the authenticated user's credential. A normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The stats logic later dereferences that foreign ID without user_id scoping, allowing the attacker to infer the victim's monthly-normalized cost.

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.

A vulnerability was detected in sdcb chats up to version 1.12.0. It affects the McpController function in the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the fetch-tools Endpoint component. The manipulation results in server-side request forgery. The attack can be launched remotely, and the exploit is public.

A weakness has been identified in caoqianming django-vue-admin 1.0. The vulnerability affects unknown code in the file /api/file/. Manipulating the file_id argument leads to improper access controls. The attack can be executed remotely, and the exploit is publicly available.

A security flaw has been discovered in Doccano Open Source Annotation Tools up to version 1.8.5. It affects the LabelList function in the file /v1/projects/1/category-types of the Bulk-Delete Endpoint component. Performing a manipulation results in improper access controls. Remote exploitation is possible, and the exploit is public.