CVE Vulnerability Catalog

A vulnerability in the Piwigo installer versions 16.3.0 and earlier allows PHP code injection via POST parameters for database configuration. Lack of proper input sanitization and bypass of `addslashes()` on PHP 8+ enables an unauthenticated attacker to write malicious code into a configuration file, executed on every page load.

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

An inverted-boolean bug in lettre's `boring-tls` integration (versions 0.10.1 to 0.11.21) silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker can present any chain-valid certificate for any domain and intercept SMTP submission, including PLAIN/LOGIN credentials and message contents. Other TLS backends (native-tls, rustls) are unaffected. Version 0.11.22 patches the issue.

Malicious versions of the npm package @beproduct/nestjs-auth (0.1.2–0.1.19) contained a postinstall script that exfiltrated npm tokens, GitHub tokens, AWS credentials, Vault tokens, and other secrets. Version 0.1.20 is a clean republish.

HeyForm prior to version 3.0.0-rc.7 contains a stored XSS vulnerability in the form builder. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation.

An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.

An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.

A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only checks that paths do not begin with "/" but fails to block sequences like "../". An authenticated administrator can craft a relative_path containing traversal sequences, allowing arbitrary file write to any location writable by the Pulp service user.

A Blind SQL injection vulnerability has been found in Windu CMS. An unauthenticated remote attacker can inject SQL syntax into the URL path in HTTP headers. Confirmed in version 4.1, but other versions may also be affected.

A heap-based buffer overflow in FreeRDP before version 3.28.0 (affected <=3.27.1) in the crypto_rsa_common() function. The function writes the modular exponentiation result to the output buffer before checking bounds, allowing out-of-bounds writes.

Vulnerability in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert, so client certificates were not validated. A remote attacker can connect as an unauthenticated agent and intercept control-plane-to-node traffic.

Vulnerability in Crypt::Password for Perl up to version 0.28 causes generation of insecure, predictable salt values using the built-in rand function, which is unsuitable for cryptographic purposes.

The Kirki WordPress plugin before version 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

The Meshtastic GitHub repository before version 2.7.21.1370b23 has a vulnerability in the main_matrix.yml workflow triggered by pull_request_target. Multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_association: "NONE" automatically triggered CI. The workflow directly executes attacker-controlled files from the fork checkout. This could lead to supply chain compromise, runner compromise, or repository takeover. The fix is in version 2.7.21.1370b23.

In the Linux kernel, the idpf driver has a bug in idpf_ptp_init() where the read_dev_clk_lock spinlock is initialized after the PTP auxiliary worker is scheduled, which can immediately try to acquire the lock, causing a lockdep warning about registering a non-static key.

In the Linux kernel, a vulnerability was found in the netfs mechanism, involving potential tearing when reading and writing the ->remote_i_size and ->zero_point fields. The issue stems from insufficient synchronization, which could lead to data corruption.

In the Linux kernel, a bug was found in the netfilter nft_inner module's error path where local_bh_enable() is called before local_unlock_nested_bh(), potentially causing incorrect lock state and synchronization issues.