CVE Vulnerability Catalog

Pimcore prior to versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in the class-definition import endpoint where a DataObject field name is emitted without an identifier allowlist, allowing an authenticated user with objects permission to inject PHP syntax into generated DataObject classes and inject SQL identifier content into schema-changing statements. The setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters.

phpSysInfo prior to 3.4.6 contains a vulnerability in the PSI_ALLOWED access-control check in read_config.php, which trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6.

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.

Yamcs prior to versions 5.12.8 and 5.13.2 has a vulnerability in LikeExpression.fillCode_getValueReturn where a LIKE pattern is not properly escaped and is inserted into Java source compiled by SimpleCompiler.cook. The pattern can originate from various API endpoints, and a quote in the pattern can inject Java that runs as the Yamcs server process.

Yamcs prior to versions 5.12.8 and 5.13.2 inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Successful exploitation executes commands as the Yamcs service account.

Yamcs prior to 5.11.13 contains a vulnerability in StaticFileHandler.locateFile, which resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.

Yamcs before version 5.9.4 reflects the attacker-controlled redirect_uri parameter from GET /auth/authorize into authorize.html without adequate HTML escaping. A crafted authorization URL can execute JavaScript when opened by a Yamcs user, allowing theft of authentication material and account compromise.

Yamcs before versions 5.12.8 and 5.13.2 omits SystemPrivilege.ControlAccess checks in IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings.

Yamcs before versions 5.12.8 and 5.13.2 fails to enforce privileges required by equivalent REST endpoints in WebSocket subscription handlers. Specifically, subscriptions to packets, algorithm status, and mission database changes are available without required privileges, allowing low-privilege users to receive sensitive data.

Yamcs before versions 5.12.8 and 5.13.2 omits authorization checks in several API endpoints such as IndexesApi, Cop1Api, and TimeApi. An authenticated low-privilege user can read packet and event metadata, alter COP-1 link state, and manipulate simulation time.

Protego before version 0.6.2 translates every asterisk in Allow or Disallow directives into a lazy regex wildcard, causing exponential backtracking with many asterisks. Processing a crafted robots.txt can cause long URL matching and denial of service.

Yamcs before versions 5.12.8 and 5.13.2 allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source. Via the POST /api/archive/{instance}:executeSql endpoint, arbitrary Java code can be executed in the Yamcs server process, potentially exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

WsgiDAV before version 4.3.5 includes a sample MySQLBrowserProvider that concatenates record keys from request URLs directly into SQL WHERE clauses. An attacker with access to a share configured with this non-default provider can inject SQL via a normal GET request.

Piccolo Admin before version 1.14.0 allows non-superusers to perform GET requests on user and session tables, and the session token is not secret. A non-superuser administrator can obtain another user's session token and impersonate a superuser.

ALOS HTTP before version 0.0.0-20260617230736-314b6783e196 has a bug in sanitizeRequestPath that does not check if the path after splitting is empty. Sending a request with a question-mark-only path can cause an out-of-bounds panic and terminate the server process.

Graylog from 7.1.0 until 7.1.4 and 7.2.0-alpha.2 allows an authenticated user to request composite display fields in the System Catalog entity titles endpoint without verifying that every selected field is readable. A user can retrieve protected values, including password hashes on readable user records; ordinary users are limited to their own records, while administrators can retrieve hashes for all users.

JS Recon from 1.2.1-beta.1 to 1.3.1-beta.2 has a vulnerability in the PR Branch Checker workflow where github.head_ref and github.event.pull_request.head.repo.full_name are interpolated into a shell gh pr comment command. A remote user opening a pull request can use shell metacharacters in a branch or fork name to execute commands in the GitHub Actions runner with the workflow's GITHUB_TOKEN, which has pull-requests write permission. This issue is fixed in version 1.3.1-beta.2.

plone.app.portlets before versions 5.0.8, 6.0.4, and 7.0.2 allows a member who can add an RSS portlet to set its feed URL to a very large response, causing excessive data retention in memory and denial of service. The RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, enabling server-side requests to internal services. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

plone.app.event before versions 5.2.4 and 6.0.1 has a vulnerability in the iCalendar import that accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per event. A logged-in editor can make the server request internal network resources or local calendar files, exhaust resources, and store a malicious event URL that executes script in another user's browser. This issue is fixed in versions 5.2.4 and 6.0.1.