CVE Vulnerability Catalog

A critical unauthenticated password reset vulnerability in KMW CCTV Security Cameras. An attacker can remotely reset the administrator password to a known value without authentication, gaining full access to camera feeds and settings.

Trilium Notes is a cross-platform hierarchical note-taking application. Prior to version 0.102.2, a malicious ZIP archive imported with safe import enabled achieves RCE via #docName path traversal and XSS. It combines a payload note (type: code, mime: text/plain) containing raw HTML/JS and a trigger note (type: doc or launcher) with a #docName label using ../ path traversal to point at the payload note's API endpoint. The desktop client Electron runs with nodeIntegration enabled, so RCE is triggered once the payload is executed. This vulnerability is fixed in version 0.102.2.

A critical path traversal vulnerability in Dokploy 0.26.5 and earlier. Authenticated users can write arbitrary files during deployment, which combined with remote server feature enables remote code execution and full server compromise.

Dokploy in version 0.26.6 and earlier has a command injection vulnerability in the /docker-container-logs WebSocket endpoint. The tail and since parameters are not validated and are directly concatenated into shell commands, allowing authenticated users to execute arbitrary commands with root privileges.

Dokploy in 0.26.7 and earlier does not enforce organization/role checks in the schedule router. Any authenticated user can create, update, run, or delete schedules of other organizations if they know the scheduleId/serverId. Schedule types server and dokploy-server enable code execution on the host or remote server (RCE).

Dokploy versions 0.27.0 through 0.29.3 contain a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789"), allowing an unauthenticated attacker to forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal.

Dokploy 0.28.8 and earlier contains an authenticated OS command injection vulnerability in the application.updateTraefikConfig tRPC endpoint. Admin/owner users can execute arbitrary system commands on remote servers via unsanitized echo shell interpolation.

Dokploy 0.28.8 and earlier contains an authenticated OS command injection vulnerability in the /listen-deployment WebSocket endpoint. Any organization member can execute arbitrary system commands on remote servers managed by Dokploy, leading to full server compromise.

Dokploy, a self-hosted PaaS, in version 0.29.2 and earlier constructs shell commands using JavaScript template literals and executes them via child_process.exec() without proper escaping of user input.

Arcane prior to version 1.19.0 has a vulnerability where eight REST API endpoints related to Git repositories lack admin role verification. This allows any logged-in user with the default user role to manage Git repository configurations and exfiltrate stored credentials (PATs, SSH keys) by repointing a repository to an attacker-controlled host.

In Dokploy version 0.29.1 and earlier, a command injection vulnerability exists in the Docker file upload functionality. The destinationPath parameter is not properly sanitized and is directly interpolated into a shell command, allowing an authenticated user to execute arbitrary OS commands on the Dokploy host.

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.

The WP Travel Pro plugin for WordPress up to version 10.6.0 is vulnerable to unauthorized user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint. The check_permission() callback unconditionally returns true and the Database::delete() method passes the user ID directly to wp_delete_user() without role validation.

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module. The /execute/{method_name} and /simple_execute/{method_name} endpoints deserialize attacker-controlled HTTP request bodies using pickle.loads(). A remote attacker can supply a crafted pickle payload to these endpoints to execute arbitrary code in the server process, resulting in full container compromise when running in the default Docker deployment as root.

A vulnerability in FreePBX from version 15.0.42 to before 16.0.45 and 17.0.7 allows unauthenticated users to access the User Control Panel (UCP) using hard-coded initial template credentials if the administrator did not change them immediately after enabling UCP. This issue is fixed in versions 16.0.45 and 17.0.7.

A vulnerability in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) stems from incorrect permission settings on a critical resource, causing backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. An attacker with network access can directly download backup ZIP files via ‘http(s)://[server]/download/…’ without authentication.

A path traversal vulnerability in Remote Spark SparkView allows reading and writing arbitrary files in all directories as root, leading to remote code execution (RCE). The affected component is the RDP drive redirection. Depending on the implementation, the vulnerability can be exploited by an unauthenticated attacker.

RAGFlow 0.24.0 and earlier contain a Jinja2 template injection vulnerability in the prompt generator (rag/prompts/generator.py). This allows any authenticated user to execute arbitrary OS commands on the server.

In RustFS prior to version 1.0.0-beta.2, a vulnerability exists in the PUT /rustfs/admin/v3/import-iam endpoint. Improper validation allows a user with ImportIAMAction to create service accounts under arbitrary parent identities, including the root user (minioadmin). An attacker can set their own credentials, leading to privilege escalation to full administrative access.

DreamMaker by Interinfo has an arbitrary file upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.