CVE Vulnerability Catalog

Grav is a file-based web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, there was a Path Traversal vulnerability in the FormFlash core component, allowing unauthenticated attackers to manipulate the filesystem.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, an authenticated user with administrative privileges could achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the 'Direct Install' tool.

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0 contain a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for the attacker.

WordPress Plugin Download From Files version 1.48 and earlier has an arbitrary file upload vulnerability. Unauthenticated attackers can upload malicious files by manipulating the allowExt parameter in the AJAX action.

OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments.

WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the config_file endpoint to achieve remote code execution on the server.

WordPress TheCartPress 1.5.3.6 has an unauthenticated privilege escalation vulnerability. Attackers can create an administrator account by sending a crafted POST request with tcp_role set to administrator.

OpenCart version 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, when SOAP requests result in an error, persistence is handled incorrectly, freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, impacting confidentiality, integrity, and availability.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

ArchiveBox versions 0.8.6rc0 and earlier have a vulnerability in the /add/ endpoint. The config JSON field is merged into the crawl config without validation, allowing injection of tool arguments and remote code execution (RCE).

Pelican versions 7.21.0 to 7.21.4, 7.22.0 to 7.22.2, 7.23.0 to 7.23.2, and 7.24.0 to 7.24.1 have a privilege escalation vulnerability in the WebUI. An attacker authenticated via OAuth can gain admin privileges under certain configurations.

A critical vulnerability in phpVMS before version 7.0.6 allows unauthenticated attackers to access a legacy import feature. This issue has been patched in version 7.0.6.

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived from user-controlled input, it may contain CRLF sequences, which an attacker can use to inject arbitrary IMAP commands.

The auth library (versions 1.18.0 to 1.25.2 and 2.0.0 to 2.1.2) incorrectly maps all authenticated Patreon users to the same local ID. This collapses identities, leading to unauthorized access and subscription data leakage.

Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.

Termix prior to version 2.1.0 contains a command injection vulnerability in Docker container management endpoints, where the containerId parameter is directly interpolated into shell commands, allowing an authenticated attacker to achieve remote code execution on the managed server.