CVE Vulnerability Catalog

Vulnerability in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06. An unknown function in the file /business/qnaire/upload.jsp allows unrestricted file upload via the File argument. The attack can be performed remotely, and the exploit is publicly available.

Denial of service (DoS) vulnerability in Tenda TX9 firmware version V22.03.02.20 in the update_dev_name function of the file /goform/SetOnlineDevName. The attack can cause device unavailability.

Improper certificate validation in Apache MINA SSHD (server-side). The server did not check for force-command or verify-required options in OpenSSH certificates, allowing an authenticated user to execute other commands than specified. Fixed in versions 2.19.0 and 3.0.0-M5.

A path traversal vulnerability in the sshd-git component of Apache MINA SSHD on Windows allows an authenticated remote user to access git repositories outside the configured server root directory. The fix for CVE-2026-48827 was partially ineffective on Windows.

Path traversal vulnerability in the sshd-scp component of Apache MINA SSHD. A malicious sender can send filenames containing paths, allowing files to be written to arbitrary locations. Affects applications using SCP to receive files.

Paymenter before 1.5.1 has a vulnerability in the checkout component allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters, potentially overriding resource limits without privileges.

BOLA/IDOR vulnerability in NextCRM (versions prior to 0.12.0) in CRM contact and target update endpoints. An authenticated user can modify data belonging to other users or organizations.

BAC vulnerability in NextCRM (versions before 0.12.0) allows any authenticated user (even with 'member' or 'viewer' role) to activate or deactivate any user account, including the admin. Missing admin role check in activateUser and deactivateUser actions.

VSee Clinic 7.1.26 and API 1.3.0 contain an IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' parameter to enumerate, retrieve, and delete other users' files.

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present only when SFTP connections have been configured. No authentication is required. An unauthenticated remote attacker who observes these HTTP responses can obtain the credentials and access the associated SFTP server.

FreeScout before version 1.8.224 has an incomplete denylist of dangerous file extensions, missing the .pht extension. An authenticated agent can upload a .pht web shell, leading to remote code execution on the web server.

Vulnerability in FreeScout before version 1.8.223. An unauthenticated attacker can inject a message into any existing support conversation by sending an email with a crafted In-Reply-To header. The message appears as a customer reply, and the conversation is automatically reopened.

BuildKit on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. An untrusted user building an image on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the daemon process.

FileCodeBox before version 2.4 has a rate-limit bypass vulnerability in the IPRateLimit class. An unauthenticated attacker can supply controlled X-Real-IP and X-Forwarded-For headers without trusted reverse proxy verification, allowing enumeration of share codes and retrieval of other users' files.

Vulnerability in Net::DNS for Perl up to version 1.55. Allows DoS via deep DNS compression pointer chains. The decode function recursively processes pointers without depth limit, potentially overflowing the stack and causing SIGSEGV.

Cookie injection vulnerability in Adminer before version 5.4.3. Attackers can manipulate cookie attributes via unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. This can downgrade SameSite protection and enable cross-origin authenticated requests.

Glance through version 0.8.5 has an IP address spoofing vulnerability in the authentication handler. An unauthenticated attacker can bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For header when the server proxied option is enabled. Each login attempt appears to come from a different IP, preventing lockout and allowing unlimited password guessing.

SSRF vulnerability in Huginn through 2022.08.18 in the fetch_url method of ScenarioImport allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. The attack can be used to scan internal services and access cloud metadata.

SSRF vulnerability in HyperDX before version 2.31.0. Authenticated team members can direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, without URL validation or allowlist. Attackers can exploit error responses to disclose internal service responses.

Roo Code through 3.54.0 has a command injection vulnerability in the auto-approve execute feature. Attackers can bypass allowlist/denylist by nesting command substitutions inside parameter expansion defaults, allowing arbitrary command execution.