CVE Vulnerability Catalog

The Joomla extension 4Analytics below version 5.0.2 is vulnerable to unauthenticated stored XSS in the AI analysis feature. An attacker can inject a malicious script that will be executed in other users' browsers.

In Apache Fineract up to version 1.14.0, the Office Search API (GET /api/v1/offices) is vulnerable to SQL injection. The orderBy parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL. This bypasses the ColumnValidator fix for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY clause.

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) up to version 1.14.0. The orderBy and sortOrder parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with client view permission to inject arbitrary SQL via a crafted orderBy value.

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL.

The Joomla extension EDocman versions below 3.9 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.

The Joomla extension DP Calendar versions 8.18.0 through 10.11.2 is vulnerable to unauthenticated blind SQL injection. An attacker can send crafted queries without authentication.

The HCM system developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, compromising the confidentiality, integrity, and availability of database data.

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

A flaw in the OpenShift GitOps operator allows the ClusterRole reconciler to delete ClusterRole objects without validating ownership. A namespace-scoped Argo CD instance can delete a cluster-scoped ClusterRole by crafting a name collision, causing a denial of service.

The HYPER SBI 2 installer insecurely loads Dynamic Link Libraries. If a crafted DLL is present in the same directory when the installer is invoked, arbitrary code may be executed with the privilege of the user running the installer.

The Quotes llama WordPress plugin before version 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

The Shibboleth WordPress plugin before version 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request carrying identity headers as an authenticated session without verifying them.

A vulnerability in the Aura Wallpaper Service allows a local user to perform file operations by sending crafted commands containing an arbitrary file path, bypassing the service's path restrictions. On specific models, this can also cause a single feature to become unavailable.

A vulnerability in ASUS GameSDK allows a remote attacker to obtain a local user's NTLM hash by tricking the user into visiting a crafted web page that sends a request containing a UNC path to the application's local service endpoint.

A vulnerability in the ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager drivers allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests, bypassing OS-enforced memory protections.

A vulnerability in the ASUS System Control Interface driver and ASUS Business Manager allows a local administrator to disclose sensitive information via crafted IOCTL requests. In severe cases, this may lead to a Denial of Service (DoS) on the system.

A vulnerability was found in the Backend User Endpoint component of xianyu-auto-reply, involving missing authorization. The attack can be initiated remotely via manipulation of the /api/v1/users/ file. The exploit has been made public.

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).