CVE Vulnerability Catalog

A weakness has been identified in OpenBoxes up to 0.9.2 in the Product Supplier Edit Controller component, in the file RoleInterceptor.groovy. Manipulation can lead to improper authorization. The attack can be performed remotely, and the exploit is publicly available.

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI. The code does not limit the schemes allowed in this URL, allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0, affecting an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.3.2. Unauthenticated attackers can retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, taxonomies, form scheme metadata, contact options, and custom field meta keys.

A flaw has been found in COMFAST CF-N1-S 2.6.0.1, impacting the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid. Manipulation of the argument ssid causes OS command injection. Remote exploitation is possible and the exploit has been published.

A vulnerability has been detected in sonos tract up to 0.23.4, impacting the function Tensor::from_raw_dt_align of the file data/src/tensor.rs in the ONNX Initializer Loader component. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely and the exploit has been disclosed publicly. The patch is identified as 66b10bda8895f4bfaf8c205361f0125cdf51f99b.

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22, affecting the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs in the GGUF Tokenizer component. Manipulation of the arguments eos_token_id/bos_token_id/unknown_token_id results in out-of-bounds read. The attack can be executed remotely and the exploit is now public. Upgrading to version 0.8.23 can resolve this issue.

A weakness has been identified in PHPGurukul Complaint Management System 1.0, affecting the file user/check_availability.php. Manipulation of the argument email causes SQL injection. Remote exploitation is possible and the exploit has been made public.

A vulnerability was determined in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewbilling.php. Manipulation of the argument delid leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in itsourcecode Hospital Management System 1.0, affecting an unknown function of the file /viewdepartment.php. Manipulation of the argument delid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.

A SQL injection vulnerability was found in itsourcecode Hospital Management System 1.0 in the file /viewroom.php. Manipulation of the argument delid in an unknown function allows remote attack execution. The exploit has been publicly disclosed and may be used.

A basic cross-site scripting (XSS) vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/register, in the Customer-Registration Notification Email component. Manipulation of the first_name/last_name arguments allows remote attack. The exploit has been published and may be used. The vendor confirms the issues were already identified internally and are being addressed.

A vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/account/rma/store, involving enforcement of behavioral workflow. Manipulation of the rma_qty/resolution_type/rma_reason_id arguments allows remote attack. The exploit is now public and may be used. The vendor confirms the issues were already identified internally and are being addressed.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0, affecting the file /edit_subject1.php. Manipulation of the argument ID leads to SQL injection. The attack can be carried out remotely and the exploit has been disclosed publicly.

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0, affecting the file /edit_subject2.php. Manipulation of the argument ID leads to SQL injection. The attack can be executed remotely and the exploit has been made public.

Mattermost versions 10.11.x <= 10.11.20 and 11.7.x <= 11.7.5 fail to remove thread membership records when a user is removed from or leaves a team, allowing a previously removed user who is later re-invited to view private channel thread root post content and metadata via the team threads API.

Mattermost Desktop App versions <=6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, allowing a local attacker with access to the report or log files to obtain the plaintext pre-auth secret via inspecting the Server Connectivity (Step-3) diagnostics output.