CVE Vulnerability Catalog

A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.

A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

The ash_sqlite library (ash-project) has an improper neutralization of special elements in data query logic vulnerability. An attacker who controls a get_path/2 segment can traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. This happens because the JSON path is built by concatenating segments without proper escaping.

A vulnerability in the qs library allows bypassing the arrayLimit for comma-separated values when comma: true and throwOnLimitExceeded: true are used. This affects bracket-push keys (a[]=), where the value is split into an array without checking the limit, enabling allocation of arbitrarily large arrays. The issue affects versions >=6.14.2 <6.16.0 and is fixed in 6.16.0.

The ash_paper_trail library (ash-project) has an inefficient algorithmic complexity vulnerability. A user who can submit a large array attribute to a paper-trailed create or update action can cause a denial of service through excessive CPU and memory use. This results from cubic scaling of list comparison operations in full-diff mode.

The MasterStudy LMS WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.

multer before version 2.3.0 has a race condition vulnerability in file stream handling when an asynchronous fileFilter is used together with the fileSize limit. This allows bypassing the rejection of files exceeding the size limit.

StorageGRID versions 11.5 and later in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.

Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_files. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called 35d97bca0531894da36a85aedb95312da1bd5b7a.

In CodeChecker through 6.28.2, there is a flaw in ldlogger-tool-gcc.c:129 where the safe_strcpy() helper (which is strncpy()) writes 4096 bytes into a buffer of 4094 bytes, causing a 2-byte stack overflow on every invocation, independent of the input path's length. The fix for CVE-2025-40843 replaced unchecked strcpy() with a bounded safe_strcpy(), but the size passed was incorrect.

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME obtained from ContentResolver.query() directly in file path construction without sanitization. A malicious Android app with a crafted ContentProvider can return a filename containing ../ sequences, causing the plugin to create arbitrary files and directories outside the intended cache directory within the victim app's internal storage. Existing files are not overwritten due to an existence check.

In gitoxide before 0.38.2, carriage return characters in URL values passed to credential helpers are not properly validated. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.

In filebrowser from version 2.24.0, there is a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.

In filebrowser through 2.63.23, share records are not removed when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any new, unrelated file later appears at the original shared path — via re-upload, another user with create permission, or a hook — the stale public share link serves that new file under the original link's password and expiry settings, unexpectedly exposing it.

File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication.

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed, allowing sustained CPU consumption, and the leftover files increase disk consumption. Both can cause degradation of service for mail delivery. Monitor system for abnormal CPU usage and disk consumption. Update to non-vulnerable version. No publicly available exploits are known.