CVE Vulnerability Catalog

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing the victim into the attacker's account so default data sync uploads saved hosts, passwords, and private keys.

Gerapy up to 0.9.13 contains a path traversal vulnerability in the project_create function of gerapy/server/core/views.py (Project Management component). Manipulating the project_name argument leads to path traversal. Remote exploitation is possible and the exploit has been disclosed publicly. The patch identifier is 6e481078cfba6388a67ca2d9792288405019ba3e.

A vulnerability was detected in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown functionality of admin/admin.php (Role Attribute Handler component). Manipulating the Name argument leads to authorization bypass. The attack can be launched remotely and the exploit has been publicly disclosed. The product does not use versioning, so affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed but has not responded.

A SQL injection vulnerability was identified in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown function of admin/admin.php (Order Assignment Block component). Manipulating the order_id/delivery_person_id arguments leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available. The product uses a rolling release, so no version details are available. The project was informed but has not responded.

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb.

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208.

A flaw has been found in invariant-systems-ai aiir up to 1.7.0 in an unknown function of the Policy Gate Handler component. Manipulation can lead to improper verification of cryptographic signatures, and the attack can be executed remotely. The project is no longer maintained and its GitHub repository is unavailable.

YesWiki before 4.6.7 contains a cross-site scripting (XSS) vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP (mindio-magic-mcp) allows Retrieve Embedded Sensitive Data. This issue affects Mindio Magic MCP from n/a through 0.5.6.

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID to obtain refIDs and refCount of hidden referencing blocks, bypassing the publish confidentiality boundary.

A path traversal vulnerability was detected in RainyGao DocSys up to 2.02.85 in the DocController.doGetTmp function of /Doc/doGetTmpFile.do (Document Controller component). Manipulation of the path/fileName arguments leads to path traversal. Remote exploitation is possible and the exploit is publicly disclosed.

A SQL injection vulnerability was found in Discuz! X5.0 (versions 20260801, 20260820, 20260910) in the modmedalsubmit function in mod.php. Manipulation of the argument delete results in SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability has been found in Weaviate Verba up to 2.1.3 in the get_environment function of goldenverba/components/util.py, part of the generate_stream Endpoint component. The manipulation leads to information disclosure. The attack can be performed remotely and the exploit has been publicly disclosed.

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in topoteretes cognee up to 1.5.4 in the get_user_id_by_email function of cognee/modules/users/authentication/get_api_auth_backend.py, part of the JWT Signing Key Handler component. Manipulation of the FASTAPI_USERS_JWT_SECRET argument results in hard-coded credentials. The attack can be launched remotely.

A vulnerability was found in Laradock up to 20.4 in an unknown function of workspace/Dockerfile, part of the Build Process component. The manipulation results in download of code without integrity check. The attack can be launched remotely but is highly complex and difficult to exploit. The exploit has been made public.

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations. The rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values. This allows authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end. This allows users granted access to the announcement management page (Contributor and above) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.