CVE Vulnerability Catalog

Vulnerability in Module::Load for Perl before version 0.22 allows arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG. A DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary.

The DoLeads Integrator and wp2epub WordPress plugins (versions up to 0.65) allow remote code execution (RCE) once installed on a blog. The vulnerability stems from the ability to install extensions from wordpress.org by unauthorized users.

The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.

The uncanny-automator-pro WordPress plugin before version 7.3.0.6 was distributed with malicious code after the vendor's update/distribution infrastructure was compromised. The injected backdoor grants unauthenticated attackers an administrator session on affected sites and exfiltrates secret keys and administrator details to attacker-controlled servers.

In Coolify prior to version 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization. This allows a low-privileged team member to connect to terminal routes and execute commands on team servers.

In Coolify prior to version 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands.

Coolify prior to version 4.0.0-beta.464 has a vulnerability in the cloneTo() Livewire action in ResourceOperations.php. The authorization only checks the source resource, but destination resources are resolved using unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources.

Crawl4AI before version 0.9.0 has a vulnerability in the Docker API that allows injecting arguments into the Chromium browser. An attacker can use Chromium switches to replace the child process launch command, leading to arbitrary code execution in the container.

In Crawl4AI before version 0.9.0, a vulnerability allows arbitrary file write due to insufficient path confinement. An attacker can control the destination filename via Content-Disposition header or suggested filename, leading to file write outside the downloads directory. This can escalate to remote code execution.

In Traefik prior to versions v2.11.51, v3.6.22, and v3.7.6, the BasicAuth, DigestAuth, and ForwardAuth middlewares fail to strip underscore-variant identity headers that backends normalize to dashed forms. An attacker can inject such a header to spoof identity or bypass authorization.

FOSSBilling versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability. An attacker can mark any unpaid invoice as paid and credit the client account by sending a single crafted HTTP request to the IPN callback endpoint.

Coolify prior to version 4.0.0-beta.469 contains an authenticated remote command injection vulnerability in application deployment handling. An authenticated user with application write permissions can exploit fields like dockerfile_location and deployment commands to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs.

A hidden backdoor authentication mechanism was discovered in the /bin/httpd binary within the login() function at address 004c88b8. After normal MD5/hash-based authentication fails, the system reads a backdoor password from the device configuration (sys.rzadmin.password) and compares it in plaintext using strcmp(). A match grants admin-level access (role=2) regardless of the username.

Esri ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload, potentially allowing for other attacks.

ArcGIS Server contains a directory traversal vulnerability. An unauthenticated attacker can send crafted path parameters, allowing overwriting sensitive files on the system. Exploitation can lead to full administrative access to ArcGIS Server, with high impact on confidentiality, integrity, and availability.

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by improper input validation, potentially leading to remote arbitrary code execution in the context of the current user. Exploitation does not require user interaction and the scope is changed.

A high-severity vulnerability was found in the web application component of BeyondTrust Remote Support and Privileged Remote Access related to input parameter processing. Insufficient input validation may allow an authenticated attacker with limited privileges to access unauthorized resources or data beyond their scope.

A critical pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.