CVE Vulnerability Catalog

SQL Injection vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to inject malicious SQL code into queries.

SQL Injection vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to inject malicious SQL code into queries.

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress up to version 1.0.3 is vulnerable to Path Traversal via the `id2wp_path` parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

A path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

The MasterStudy LMS WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release but this one was not, so the issue persists in versions the earlier advisory reports as fixed.

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the plugin itself; if one is present via another installed plugin, this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, caused by an unchecked copy of the Sec-WebSocket-Version header through snprintf.

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype, and in versions 1.11.0 through 1.12.1 it can also disclose local server file contents when externalFileAccess is set to true.

A vulnerability was detected in ShopXO up to 2.2.7 in an unknown functionality of config/ueditor.php in the Ueditor Upload Interface component. Manipulation of the path_type argument results in path traversal. The attack can be launched remotely and the exploit is publicly available.

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret to an empty string, and Config.Validate() does not reject the empty value, so a deployment without a configured secret signs and verifies session tokens with an empty HMAC key. An unauthenticated attacker who knows an existing user's ID can forge a valid session token for that user, including an administrator.

A vulnerability was identified in java110 MicroCommunity up to 2.0 in the QueryServiceSMOImpl.fallBack function of BusinessApi.java in the fallBack API Endpoint component. Manipulation of the fallBackSql argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1 in the UnmountSegment function of the RPC Path Handler component. Manipulation of the client_id/segment_id arguments causes authorization bypass. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability in pmTicket Project-Management-Software up to version 078fa56a782490c5059a0814f84df27984f4d7e2. The setSync function in /ajax/add_project.php improperly handles the conn_settings argument, leading to SQL injection. The attack can be launched remotely.

GitLab EE versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 have a vulnerability that under certain conditions could allow an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. Affects versions before 3.0.1a.

Microsoft Office Outlook contains a remote code execution vulnerability. Technical details were not provided in the description.

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.