CVE Vulnerability Catalog

WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.

WordPress TheCartPress 1.5.3.6 has an unauthenticated privilege escalation vulnerability. Attackers can create an administrator account by sending a crafted POST request with tcp_role set to administrator.

OpenCart version 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, when SOAP requests result in an error, persistence is handled incorrectly, freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, impacting confidentiality, integrity, and availability.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

ArchiveBox versions 0.8.6rc0 and earlier have a vulnerability in the /add/ endpoint. The config JSON field is merged into the crawl config without validation, allowing injection of tool arguments and remote code execution (RCE).

Pelican versions 7.21.0 to 7.21.4, 7.22.0 to 7.22.2, 7.23.0 to 7.23.2, and 7.24.0 to 7.24.1 have a privilege escalation vulnerability in the WebUI. An attacker authenticated via OAuth can gain admin privileges under certain configurations.

A critical vulnerability in phpVMS before version 7.0.6 allows unauthenticated attackers to access a legacy import feature. This issue has been patched in version 7.0.6.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.

The auth library (versions 1.18.0 to 1.25.2 and 2.0.0 to 2.1.2) incorrectly maps all authenticated Patreon users to the same local ID. This collapses identities, leading to unauthorized access and subscription data leakage.

Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.

Termix prior to version 2.1.0 contains a command injection vulnerability in Docker container management endpoints, where the containerId parameter is directly interpolated into shell commands, allowing an authenticated attacker to achieve remote code execution on the managed server.

Sentry, an error tracking and performance monitoring tool, from version 21.12.0 to before 26.4.1 contains a critical vulnerability in the SAML SSO implementation. An attacker can take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim's email address must be known. The issue is patched in version 26.4.1.

FastGPT versions 4.14.10 through 4.14.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability in the agent-sandbox component. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080), allowing any user with network access to bypass authentication and gain full control over the sandbox environment.

Postiz, an AI social media scheduling tool, prior to commit da44801 contains a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow. Any unauthenticated user can execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions) by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.

Plunk is an open-source email platform that, prior to version 0.9.0, did not verify the SNS signature, certificate, or topic ARN for Amazon SNS notifications at the /webhooks/sns endpoint. This allows attackers to forge webhook requests.

n8n-MCP, an MCP server, has an authenticated server-side request forgery vulnerability affecting webhook trigger tools and the n8n API client. This issue exists in versions from 2.18.7 to before 2.50.2 and has been patched in version 2.50.2.