CVE Vulnerability Catalog

ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.

ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile, which executes when the administrator views their own profile page. The vulnerability combines an Insecure Direct Object Reference (IDOR) and a Broken Access Control flaw.

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/cs_disasm_iter memcpy more than 24 bytes into cs_insn.bytes, causing a heap buffer overflow in the disassembly path. Commit cbef767ab33b82166d263895f24084b75b316df3 fixes the issue.

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6: directories and files created by the agent have overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.

In DriveLock versions 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*, an incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).

Zidentyfikowano podatność w systemie zamówień online itsourcecode Cake Ordering System w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku /updateproduct.php?action=edit, co prowadzi do możliwości wstrzyknięcia SQL.

In DriveLock versions 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6, users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.

In DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5, local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers.

In DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5, an issue was discovered where an unprivileged user could occasionally cause a Blue Screen of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.

In DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5, authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.

Homarr prior to version 1.45.3 lacks sanitization of inputs in LDAP search queries, allowing privilege escalation and access to other users' groups. The vulnerability affects instances using LDAP authentication where an attacker has access to a user account. Version 1.45.3 patches the issue.

In RIOT OS v2025.07, a vulnerability was discovered in the IPv6 fragmentation reassembly implementation. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to use to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.

HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) has improper management of Content Security Policy, which may allow the execution of malicious code in web pages.

Narzędzie nbconvert, używane do konwersji notatników Jupyter na różne formaty, ma podatność w wersjach do 7.16.6 na systemie Windows. Konwersja notatnika zawierającego wyjście SVG do formatu PDF może prowadzić do nieautoryzowanego wykonania kodu.

A logic issue was addressed with improved validation. This issue affects macOS. An app may bypass Gatekeeper checks.

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An app may be able to access sensitive payment tokens.

A logic issue was addressed with improved validation. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.2. An app may be able to access sensitive user data.

A logic issue was addressed with improved checks. This issue affects macOS. An app may be able to break out of its sandbox.

A permissions issue was addressed with additional restrictions in Apple systems. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to identify what other apps a user has installed.