CVE Vulnerability Catalog

A vulnerability was found in OpenBoxes up to 0.9.7 in the Role Interceptor component, in the needManager function of RoleInterceptor.groovy. Manipulation can lead to improper privilege management. The attack can be performed remotely, and the exploit is publicly disclosed.

A vulnerability was found in OpenBoxes up to 0.9.7 in the Upload function of ProductController.groovy in the Product Upload Endpoint component. Manipulating the params.url argument results in server-side request forgery. The attack can be carried out remotely, and the exploit is public.

A SQL injection vulnerability has been found in Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. It affects an unknown function in the file /osrf-gateway-v1 of the open-ils.fielder OpenSRF Service component. The attack can be executed remotely, and the exploit has been publicly disclosed.

A vulnerability was detected in SourceCodester Stock Management System 1.0 in the file /classes/Master.php?f=delete_supplier. Manipulating the ID argument results in SQL injection. The attack can be launched remotely, and the exploit is public.

A vulnerability has been detected in the Tenda AC10 router version 16.03.10.09_multi_TDE01. It affects the R7WebsSecurityHandler function in the httpd component, leading to improper authentication. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A weakness was identified in code-projects Online Shopping System 1.0 in the file /checkout_process.php. Manipulating the total_count argument can lead to SQL injection. The attack can be launched remotely, and the exploit is public.

A security flaw was discovered in code-projects Online Shopping System 1.0 in the file /checkout.php. Manipulating the amount_1 argument results in cross site scripting. The attack can be initiated remotely, and the exploit is public.

A vulnerability was identified in code-projects Online Shopping System 1.0 in the file /homeaction.php. Manipulating the cat_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was determined in code-projects Online Shopping System 1.0 in the file /action.php. Manipulating the proId argument causes SQL injection. The attack can be initiated remotely, and the exploit is publicly disclosed.

A SQL injection vulnerability has been found in the Online Shopping System 1.0 by code-projects. It affects an unknown function in the file /login.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit has been made public.

A vulnerability was found in SpaceX Starlink Router Gen 3 version 2025.11.14.mr64708.3 in the get_status function of the gRPC Management Interface component. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit is public, and the vendor did not respond.

A flaw has been found in code-projects Online Food Order System 1.0. An unknown function of the file delete_food_items1.php is affected. Manipulation of the argument checkbox leads to SQL injection. The attack can be executed remotely. The exploit has been published and may be used.

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image, compressed chunks are decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker can submit a crafted DAA file with highly compressed data, causing excessive memory and CPU consumption, potentially making the extraction worker unresponsive or terminating it, affecting service availability.

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a TAR archive, member names are passed directly to Python's tarfile.TarFile.extract() without an extraction filter. An attacker can submit a crafted TAR archive with malicious paths, allowing files to be written outside the intended directory.

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.

SiYuan before v3.7.4 contains an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code execution on the host system.

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.

SiYuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.