CVE Vulnerability Catalog

Leantime is an open source project management system. Prior to 3.10.0, the JSON-RPC API surfaces lack per-method authorization, allowing a low-privilege authenticated user to create an administrator account and manage plugins without proper permissions.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, in worker mode, when the session extension is loaded as a shared module, PHP session state can be retained between requests, leading to cross-user session exposure and possible session hijacking.

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

Argo CD from 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.

Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to improper enforcement of behavioral workflow, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding, accepting the prohibited 'Transfer-Encoding: identity' form.

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application.

Cronicle prior to 0.9.119 concatenates the attacker-controlled item.user.full_name value into HTML in the administrator Activity Log (htdocs/js/pages/admin/Activity.js) without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update their own name through /api/user/update, and when free_accounts is enabled an anonymous attacker can plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution. This issue is fixed in version 0.9.119.

RClone Manager prior to 0.2.7 starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files. The possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can retrieve user data from another tenant or the master realm, breaking tenant isolation.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method processes 0.xml from an uploaded ETS project ZIP with XML parsers that permit external entity resolution, allowing file reads accessible to the JVM process or server-side requests.

OpenCATS prior to 0.10.0, in the Import module (modules/import/ImportUI.php), can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges. This issue is fixed in version 0.10.0.

Citrix UniconOS contains an improper link resolution before file access ('link following') vulnerability. This issue affects versions before 2607 CR and before 2603 LTSR CU2.

A vulnerability in the Bluetooth Classic Hands-Free Profile Audio Gateway (HFP AG) implementation in Zephyr RTOS causes corruption of the kernel timeout list. By sending AT+CIND? and quickly reconnecting, a remote attacker can trigger a system-wide fault or hang.

In the AVDTP signalling layer of the Zephyr RTOS Bluetooth stack, the L2CAP disconnect handler (bt_avdtp_l2cap_disconnected) failed to cancel the armed delayed timeout_work, leaving it linked in the kernel's global timeout list. When the bt_avdtp session struct is zeroed by memset() on reconnect, the kernel treats the still-linked timeout node as free, corrupting the global timeout list and causing a system-wide crash or hang. The vulnerability requires CONFIG_BT_A2DP (experimental) to be enabled and an encrypted BR/EDR link.

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints. Unauthenticated attackers can read unpublished draft and soft-deleted articles by requesting sequential article ids or supplying isDraft=true or isDel=true query parameters.

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint. Authenticated members can read other members' refund records by registering freely and enumerating sequential refundId values, obtaining buyers' names, national ID numbers, addresses, WeChat openIds, and order details.