CVE Vulnerability Catalog

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the underlying system.

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as /api/model_report/file/download?index=/&ext=<path> to traverse the filesystem and disclose sensitive files including /etc/passwd, application database files, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-04 .

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application configuration files, and to reach internal network hosts and services not otherwise accessible. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-26.

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py to scan excessive input through read_until_whitespace, resulting in long runtimes and application unavailability. This issue is fixed in version 6.18.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document page labels, consuming large amounts of memory and potentially making the application unavailable. This issue is fixed in version 6.17.0.

basic-ftp before version 6.2.1 contains a ReDoS vulnerability in Client.list(). A malicious or compromised FTP server can force quadratic CPU time parsing a directory listing, blocking the Node.js event loop and freezing the process.

ZeroClaw before version 0.8.5 (with plugins-wasm feature) contains a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can trick users into installing crafted plugins that write arbitrary files outside the plugins directory, such as shell startup files, enabling code execution.

OpenClaw Windows Node before version 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or java to load attacker-controlled code and achieve arbitrary code execution.

OpenClaw Windows Node before version 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules to execute arbitrary commands on the Windows host through system.run without operator checks or user prompts.

OpenClaw Windows Node before version 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing denied commands behind allowed prefixes using pipe operators or command substitution syntax, achieving arbitrary command execution on Windows hosts.

The Schema & Structured Data for WP & AMP plugin version 1.66 and earlier contains a PHP Object Injection vulnerability that can be exploited by a user with Contributor role. The vulnerability allows injection of serialized PHP objects, potentially leading to arbitrary code execution or other unauthorized actions.

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions up to 3.36.

Editor PHP Object Injection in Page Builder by SiteOrigin versions up to 2.36.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS. This issue affects CURCY: 2.2.18.

Tugtainer prior to version 1.31.3 has a vulnerability where the OIDC login flow decodes the id_token without verifying signature, audience, issuer, and expiry. Extracted claims are used directly as the user_id for the session.

MineAdmin prior to version 3.2.0-alpha.2 has a vulnerability in the app-store plugin service where unsanitized identifiers are concatenated into file paths. An attacker can use path traversal sequences to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands.

Taskcluster prior to version 100.3.0 is vulnerable to unauthenticated RCE on deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library.

Reachy Mini ISO for Wireless prior to version 0.2.4 ships with an overly broad sudoers entry granting the pollen daemon user passwordless sudo access to /usr/bin/systemctl with no restrictions. This allows local privilege escalation to full root.

yii2-starter-kit through 4.2.0 fails to validate file types in backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and execute arbitrary code on the server.