CVE Vulnerability Catalog

W systemie zarządzania biblioteką Senayan (SLiMS) w wersji 9 Bulian v.9.6.1 występuje problem, który umożliwia zdalnemu atakującemu wykonanie dowolnego kodu za pomocą komponentu scrap_image.php oraz parametru imageURL.

The MultiBoilerplate extension in MediaWiki contains a Stored XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions from master before 1.39.

The ExternalGuidance extension in MediaWiki contains a Stored XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions from master before 1.39.

The LastModified extension in MediaWiki contains a Stored XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions from master before 1.39.

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/read_own) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized operations (view/delete/modify) on files created by other users. The root cause was inferring ownership/visibility from folder names (e.g., a folder named after a username) and missing server-side authorization/ownership checks across file operation endpoints. This amounted to an IDOR pattern: an attacker could operate on resources identified only by predictable names. This issue has been patched in version 1.4.0 and further hardened in version 1.5.0. A workaround for this issue involves restricting non-admin users to read-only or disable delete/rename APIs server-side, avoid creating top-level folders named after other usernames, and adding server-side checks that verify ownership before delete/rename/move.

In NetXDuo before version 6.4.4, in the DHCPV6 client, there is an unchecked index extracting the server DUID from the server reply, which can lead to an out-of-memory read with a crafted packet.

W podatności CVE-2025-47902 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości ataku typu SQL Injection w Microchip Time Provider 4100. Problem dotyczy wersji Time Provider 4100 przed 2.5.

Podatność CVE-2025-47901 dotyczy niewłaściwej neutralizacji specjalnych elementów używanych w poleceniach systemowych w Microchip Time Provider 4100, co umożliwia atak typu OS Command Injection. Problem ten dotyczy wersji Time Provider 4100 przed 2.5.

W podatności CVE-2025-47900 w Microchip Time Provider 4100 występuje niewłaściwe neutralizowanie specjalnych elementów używanych w poleceniach systemowych, co pozwala na wstrzyknięcie poleceń systemowych. Problem dotyczy wersji Time Provider 4100 przed 2.5.

W podatności CVE-2025-3465 występuje niewłaściwe ograniczenie ścieżki do zastrzeżonego katalogu, co prowadzi do ataku typu 'Path Traversal' w produktach ABB CoreSense™ HM oraz ABB CoreSense™ M10. Problem dotyczy wersji CoreSense™ HM do 2.3.1 oraz CoreSense™ M10 do 1.4.1.12.

An authorized user may crash the MongoDB server by causing a buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. The issue affects MongoDB Server v7.0 versions prior to 7.0.25, v8.0 versions prior to 8.0.15, and version 8.2.0.

W podatności CVE-2025-9574 występuje brak uwierzytelnienia dla krytycznej funkcji w urządzeniach ABB ALS-mini-s4 IP oraz ABB ALS-mini-s8 IP. Problem ten dotyczy wszystkich wersji oprogramowania układowego z numerem seryjnym od 2000 do 5166.

The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses from the oatpp-mcp server.

ClipBucket v5 prior to version 5.5.2 #147 is vulnerable to arbitrary PHP code execution. The "type" parameter from a POST request in /upload/admin_area/actions/update_launch.php is embedded into PHP tags and executed without proper sanitization, allowing arbitrary PHP code execution.

In the Linux kernel, a vulnerability was found in the SMC (Shared Memory Communications) module. The smc_rx_splice() function calls get_page() on DMB buffers allocated by kzalloc(), which are not page-backed, triggering a WARN_ON_ONCE() and potentially leading to use-after-free.

In the Linux kernel, a vulnerability in the hugetlb mechanism was found where a race condition between migration and fallocate can occur. The remove_inode_single_folio function checks if the folio is mapped without holding the folio lock, leading to incorrect removal of a still-mapped folio and triggering a BUG in filemap_unaccount_folio.

W jądrze Linuxa zidentyfikowano podatność związaną z obsługą odpinania sterownika podczas operacji odczytu i zapisu. Wprowadzone zmiany implementują licznik odniesień, który pozwala na bezpieczne usunięcie urządzeń przed odpięciem sterownika.

Podatność CVE-2025-8884 dotyczy oprogramowania ACE Center firmy VHS Electronic Software Ltd. Co. i pozwala na obejście autoryzacji poprzez klucz kontrolowany przez użytkownika, co może prowadzić do nadużycia uprawnień oraz wykorzystania zaufanych identyfikatorów.

Apache Syncope offers the ability to extend/customize the base behavior by allowing custom implementations of Java interfaces, including Groovy classes. It was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.