CVE Vulnerability Catalog

Plane (open-source project management tool) prior to 1.4.0: the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhook_task.py performs a separate DNS resolution when sending the request and does not validate the resolved IP address, allowing DNS rebinding to bypass the SSRF protection.

Plane (open-source project management tool) prior to 1.4.0: DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface.

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane.

Reflected Cross-site Scripting (XSS) vulnerability in the Adsmonetizer (adsensei-b30) plugin by Jose Fernandez. The issue is due to improper neutralization of input during web page generation. The vulnerability affects all versions up to and including 3.2.4.

In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and POST `/api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns the response body to the caller. Any authenticated Che user can read arbitrary local files via the file:// scheme (including the pod's Kubernetes service-account token at `file:///var/run/secrets/kubernetes.io/serviceaccount/token`), reach internal HTTP services and cloud instance metadata endpoints (169.254.169.254), and have their stored SCM personal access token attached as an `Authorization` header to a host of their choosing. The same credential-forwarding behavior also fires when a victim opens a workspace from a malicious devfile whose `parent.uri` points to an attacker-controlled server, enabling exfiltration of the victim's SCM PAT without direct API access. No fix is available.

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require(), so running auto-changelog over attacker-controlled repository content (for example, in a CI workflow that checks out an untrusted pull request head, or locally on a forked or third-party repository) executes attacker-chosen code with the privileges of the invoking user or CI job, including access to workflow secrets, without the repository dependencies ever being installed. The plugins option similarly loads attacker-controlled modules from the repository. Under the same conditions, appendGitLog/appendGitTag allow git argument injection (e.g. --output= to write arbitrary files), output allows writing attacker-influenced content to arbitrary paths, and template causes an outbound request to an attacker-chosen URL. Version 2.6.1 treats in-repository configuration as untrusted and refuses to run when it sets these options, unless the new --unsafe-config flag is passed.

A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A flaw was found in onetwothreeneth HospitalManagementSystem in the update_subaccount function of php/controller.php (Account Administration component). Manipulating the user_id argument causes improper authorization, and the vulnerability can be exploited remotely. The exploit has been published and may be used.

In Plane (versions 0.13 to 1.4.0), the InstanceAdminSignUpEndpoint uses InstanceAdmin.objects.first() for the first-admin check and creates accounts without an atomic transaction, row lock, or uniqueness guard. Two concurrent unauthenticated requests with different email addresses can both observe no instance administrator exists, create separate accounts, and receive sessions with instance-admin authority.

In Plane prior to 1.4.0, the GET /api/workspaces/{slug}/entity-search/?query_type=user_mention endpoint returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even if not a member. It also exposes ProjectMember rows under the same condition, because SearchEndpoint inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check.

In Plane prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace via PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and inject comments into an issue from another workspace via POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope.

The Joomla extension TF Content versions 2.9.0 - 2.9.4 exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

adm-zip prior to 0.6.1 applies Unix permission bits from a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and never filters out setuid/setgid/sticky bits. A crafted zip can produce an extracted binary with mode 04755, leading to attacker code execution as root when extraction runs as root.

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.

In Plane prior to 1.4.0, the aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges.

The mppx-condition-gate and mppx-token-gate packages prior to versions 3.0.0 and 1.0.4 respectively read a wallet address from client-supplied credential.source, check whether that public address met configured on-chain conditions, and return a successful free-access receipt without invoking the payment verifier or proving caller control of the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the cache lifetime.

Kunstmaan CMS prior to 7.3.2 performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and then lowercases the stored extension. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types.

In the Joomla extension Phoca Cart versions 5.0.0 - 6.1.8, the order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user, including a guest with no account, can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.