CVE Vulnerability Catalog

Prior to version 1.4.0 of the Plane tool, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters without an allowlist and passes them to grouped paginators, where they are used as ORM field names. An attacker can supply arbitrary field paths that trigger unhandled FieldError or KeyError and HTTP 500 responses, or use them as a blind traversal oracle. The earlier fix for order_by did not cover these parameters.

Prior to version 1.4.0 of the Plane tool, a Project Member with role 15 can send a PATCH request to the project-member update endpoint and change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the validation and promotes a Project Guest with role 5 to Member without Project Admin approval.

Prior to version 1.4.0 of the Plane tool, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace.

Prior to version 1.4.0 of the Plane tool, the GET /api/users/api-tokens/ endpoint allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows modifying the allowed_rate_limit field without server-side validation. A user can raise the limit arbitrarily and bypass API rate-limiting controls, enabling high-volume automated requests and potential resource exhaustion.

The Joomla extension Event Gallery versions < 6.6.0 contains a server-side request forgery vulnerability in the Google Photos picker on the back-end upload page. The picker fetches thumbnails of picked images through the server, using the OAuth access token of the Google Photos account. The task takes the address from the request without checking it and asks for no form token. A prepared page on another web site could make the server send the access token to any address, or fetch addresses inside the server's network, in the name of a logged in administrator.

ApiAdmin v5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.

The LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

A vulnerability was found in TallCMS up to 4.8.0 affecting the PluginManager component in ThemeManager.php. Manipulation of input can lead to remote code injection. The exploit has been publicly disclosed and may be used.

In the Joomla Event Gallery extension versions below 6.6.0, there is XSS and open redirect on the share mini page. The article address from the shared link is printed without checking or escaping, and with the link type "Image Page with Redirect" it follows the address immediately.

In the Joomla Event Gallery extension versions below 6.6.0, eight tasks called by back-end list buttons do not check the form token. A prepared page on another site could trigger them in the name of a logged-in administrator and change settings and flags.

In the Dynamic Content Filter addon in SP Page Builder Pro versions 3.0.0–5.6.1p2, there is reflected XSS. The slider minimum and maximum values are taken from the dc_filter_<fieldId> parameter, split on "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content.

In mcp-k6, a caller who can invoke the convert_playwright_script prompt can pass a bare file path as the playwright_script argument and read any file accessible to the server's user, including SSH keys and cloud credentials (path traversal). The working-directory restriction for '@'-prefixed paths can also be bypassed using a symbolic link pointing outside the working directory.

In the Kit (formerly ConvertKit) for WooCommerce plugin versions up to 2.2.0, there is a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

In Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021, a TOCTOU race condition exists during installation of the HTTPS interception root certificate into the Local Computer certificate store. Fiddler writes the certificate to a temporary file in a user-writable location and then launches the elevated TrustCert helper to import it.

In Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests with multiple conflicting Content-Length headers are forwarded verbatim to the origin server, while Fiddler frames the body using only the first value.

In django-haystack up to 3.3.0, a vulnerability was found in the _to_python function in elasticsearch_backend.py, in the more_like_this template tag handler component. Manipulation of the result_class argument leads to improper neutralization of directives in dynamically evaluated code.

A vulnerability in LibreOffice allows crafting URLs that expand environment variable or INI file values, potentially leaking sensitive information to a remote server when a document containing such links is opened. The fix for CVE-2024-12426 did not cover all places where a document can supply a URL, and XForms instance data and Calc csv and sql data providers still reached the expansion. In fixed versions these places refuse URLs with internal schemes when the URL comes from the document.

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document loaded, and their contents could end up in the document. In fixed versions LibreOffice does not follow playlists that name further resources, and linked media is under link update control.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions external data links are updated under the same link update control as other links in a spreadsheet.