CVE Vulnerability Catalog

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.

abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint. An authenticated user can supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant.

SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts because verifyUser() is never called. A remote unauthenticated attacker can repeatedly POST to /api/notify, optionally with a domain parameter, exhausting SMTP rate limits, triggering provider abuse flags and flooding recipients.

Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. An attacker inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges.

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. An attacker supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio and read that device's conversation context.

WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. An attacker can attach comments to draft, private, trashed or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs and backdate comments or mark them as pingbacks.

WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. An attacker can send one HTTP request with many aliases, bypassing batch_limit, to exhaust mail provider quota and repeatedly rotate reset keys, blocking legitimate password recovery.

WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. An attacker can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types and unapproved comments.

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. An attacker can send distinct queries with matching SHA-256 queryId values, including batched operations, to grow the wp_posts table without bound and degrade database performance.

The JetFormBuilder plugin (Crocoblock) through 3.6.7.1 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This can lead to code injection in the page context.

The Events Calendar plugin (Liquid Web / StellarWP) through 6.18.2 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed for users viewing the page.

Prior to 1.4.0, @zuke/cli inspects scaffold names with lstat but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker supplying an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The issue is fixed in version 1.4.0.

The Webba Booking plugin (webba-booking-lite) is affected by a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects Webba Booking from an unspecified version through 6.5.4.

RTIR extends RT's HTML scrubber to allow an internal link placeholder and lets through any link containing that placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only RTIR's own queues. Anyone who can add HTML content to a ticket, including an unauthenticated sender of HTML email to the Incident Reports queue (open to everyone by default), can store such a link, and the script runs in the session of the user who clicks it. The issue was fixed in versions 5.0.11 and 6.0.4.

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, rendering that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject, and the script runs in the session of the handler who creates or splits the incident. The issue was fixed in version 6.0.4; RTIR 5.0 is not affected.

RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL placed in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket, including an unauthenticated sender of HTML email to any queue granting CreateTicket or ReplyToTicket to Everyone, can plant it. The issue was fixed in versions 5.0.11 and 6.0.4.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. An attacker can supply a crafted PICT file with manipulated dimensions, causing heap over-reads leading to crashes or heap memory disclosure.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS. This issue affects Blocksy Companion: from n/a through 2.1.60.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.