CVE Vulnerability Catalog

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.

The Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 contains a Server-Side Request Forgery (CWE-918) vulnerability. It may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

In Progress Telerik Fiddler Classic for Windows prior to version 6.0.20262.10021, the integrity check for external helper tools is insufficient. The application only verifies the Authenticode signature and publisher name, not that the file is the specific executable shipped with the product. A local attacker with low privileges can replace a helper executable with another validly signed binary from an allow-listed publisher, causing it to be executed, including with Administrator privileges.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early but did not respond.

A vulnerability has been detected in feelcrm-os 1.0.0 (feelec-yishu project). It affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php in the getCurlData Endpoint component. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in the system-call verifier for i3c_do_ccc() in Zephyr RTOS, which fails to validate per-target data pointers in the i3c_ccc_payload structure. The verifier also operates on the caller's live structure, allowing another thread to modify fields between check and use. This allows an unprivileged thread to write to arbitrary kernel addresses (via read CCC) or disclose kernel memory (via write CCC), leading to privilege escalation.

The NXP GAU ADC driver (adc_mcux_gau_adc.c) incorrectly validates the caller-supplied buffer size: it compares bytes against the number of channels (samples) and then uses that byte count as the number of uint16_t slots. As a result, a buffer accepted as 'large enough' can be written up to twice its size in bytes, causing an out-of-bounds write for every sample past the buffer's midpoint.

A SQL Injection vulnerability was found in itsourcecode Online Admission System Project 1.0 within the file /admin/login1.php, caused by improper handling of the User argument. The flaw can be exploited remotely and a public exploit is already available.

A vulnerability was found in DigitalCanion SA's product within the Configuration → Services → Music on Hold functionality of the web portal on TCP port 443, which fails to properly validate uploaded file types. An authenticated attacker can upload a malicious .so file instead of a WAV file, leading to remote code execution in the context of the affected process.

Mitel MiVoice Office 400 contains a directory traversal vulnerability in the web portal on TCP port 443, under Maintenance → File Management → File Browser. An authenticated attacker can access and delete files outside the intended directory, including Mitel application and underlying Linux system files.

A vulnerability was discovered in DigitalCanion's product where a privileged process loads an attacker-controlled .so file with a predictable module name without verifying its origin or integrity. The malicious module is then executed with the privileges of that process.

A vulnerability in the backup restoration functionality allows an attacker with access to the configured backup repository to introduce arbitrary files during restoration. The mechanism fails to properly validate paths, file types, integrity, and authenticity of files within a restored TGZ archive.

A path traversal vulnerability was discovered in DigitalCanion's product that allows viewing or downloading sensitive system files over the portal https://<ip>:8443 via the Administration -> View Logs menu.

The Groundhogg plugin for WordPress (versions up to 4.8.3) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

The PowerPress Podcasting plugin for WordPress (versions up to 11.17.9) contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unauthorized actions on behalf of a logged-in user.

The Sirv plugin for WordPress (versions up to 8.2.5) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.