CVE Vulnerability Catalog

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders. This means access control can be easily bypassed.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides a JWT that can be used to call an API to return a signed AWS upload URL for any store's path.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users. The flaw involves improper sharing of personal information among logged-in users.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an 'Anyone Can Join This Party' signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.

W wersjach 0.3.1 i wcześniejszych frameworka pyquokka, klasa FlightServer używa funkcji pickle.loads() do deserializacji danych akcji otrzymywanych od klientów Flight bez jakiejkolwiek sanitizacji lub walidacji. To stwarza możliwość wykonania zdalnego kodu przez atakujących, gdy FlightServer jest skonfigurowany do nasłuchiwania na 0.0.0.0.

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s textContent when copying button labels. This causes escaped HTML in system message content (such as citizen-share, citizen-view-history, citizen-view-edit, and nstab-talk) to be interpreted as HTML in the sticky header, allowing injection of arbitrary script by a user with the ability to edit interface messages.

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The Download function of the file /DeviceFileReport.do?Action=Download is affected. Manipulation of the FilePath argument results in path traversal. The attack may be initiated remotely and the exploit has been made public.

yt-grabber-tui version 1.0 contains a TOCTOU race condition (CWE-367) during creation of the default config.json file. An attacker with write access to the config directory can use a symbolic link to overwrite arbitrary files accessible to the process.

A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The Download function of the file /Service.do?Action=Download is affected. Manipulation of the Path argument leads to path traversal. The attack can be launched remotely and the exploit has been disclosed to the public.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the Query function in /DeviceState.do?Action=Query is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be initiated remotely, and the exploit is publicly available.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the Query function in /DeviceFault.do?Action=Query is vulnerable to SQL injection via manipulation of the sortField argument. The attack can be launched remotely, and the exploit is now public.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the Query function in /MemoryState.do?Action=Query is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

In LobeChat version 1.136.1, the web-crawler package allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array with impls containing the value naive, causing the server to fetch internal resources without validating private network addresses.

A Stored XSS vulnerability in the chat component of CobbleStone Enterprise Contract Management Portal v22.4.0 allows a remote attacker to execute arbitrary code in the victim's browser. The vendor states this issue is present only in an obsolete, unsupported version no longer in circulation.

An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.

An SSRF vulnerability in the Image Upload Gallery feature of ThingsBoard versions prior to 4.2.1 allows an attacker to upload a malicious SVG file referencing a remote URL. Server processing may trigger unintended outbound requests.