CVE Vulnerability Catalog

Logto before version 1.41.0 has an XML injection vulnerability in SAML, where user-controlled profile attributes (e.g., name, email) are substituted into a SAML template without proper escaping. An authenticated low-privilege user can inject XML markup into a profile attribute, forging SAML attributes like role, leading to privilege escalation in relying service providers.

Snipe-IT prior to version 8.6.2 has a vulnerability due to insufficient sanitization of uploaded SVG files. A low-privilege user can upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer's browser.

Snipe-IT prior to 8.5.0 stores the User-Agent header from requests in the action log and writes it to the Activity Report CSV without formula escaping. This allows a low-privileged authenticated user to inject a malicious formula that may execute when the CSV is opened in spreadsheet software.

Logto prior to version 1.41.0 has a vulnerability in the step-up verification mechanism in Account Center. An attacker with an API token can create and verify a WebAuthn registration for a new passkey, then use it as identity verification, allowing MFA factor management without possessing a password, identifier, or existing MFA factor.

An authorization bypass vulnerability in TeraMIS allows privilege abuse through a user-controlled key. Affected versions range from V03.26.01.14 through 30.04.2026.

A SQL injection vulnerability in Dify before version 1.16.0-rc1 in the MyScale vector store backend allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

Krayin CRM up to version 2.2.3 contains an insecure direct object reference (IDOR) vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. It allows authenticated users to edit, update, or delete records owned by other users.

A vulnerability in Snipe-IT prior to version 8.6.2 allows an authorized user to move a maintenance record to an asset outside their company scope. This occurs because PATCH or PUT requests to /api/v1/maintenances/{maintenance_id} do not re-authorize the newly supplied asset_id.

In Snipe-IT prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user.

In Snipe-IT prior to version 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model, including the company_id field. This allows a low-privileged authenticated user from one company to create accessory records under another company when Full Multiple Companies Support is enabled.

A vulnerability in Coturn prior to version 4.13.0 allows an authenticated TURN client to bypass the default loopback peer rejection by using an IPv4-mapped IPv6 address (::ffff:127.0.0.1) in the XOR-PEER-ADDRESS attribute. The loopback check does not properly handle this address type, enabling relay traffic to localhost services on the Coturn host.

A vulnerability in Coturn prior to version 4.12.0 allows SQL injection through the HTTPS admin panel. HTTP query parameters are passed directly into SQL queries without sanitization, enabling an authenticated admin to inject arbitrary SQL.

HestiaCP before version 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_dns_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

A vulnerability in ZITADEL prior to version 4.15.3 allows a low-privilege token to be exchanged for elevated permissions in another application. This occurs because the OAuth2 Token Exchange endpoint does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes.

In ZITADEL prior to version 4.15.3, the Login V2 OIDC and SAML FailedPrecondition error paths pass loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check. This allows an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reached.

In ZITADEL prior to versions 3.4.12 and 4.15.2, OAuth2 and OIDC flows (CodeExchange, RefreshToken, device token) fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client.

The grav-plugin-admin plugin in version 1.10.52 and earlier allows an authenticated attacker with admin.users permission to change the password of any user account, including the super administrator. The vulnerability exists because the saveUser function only checks general user-management permissions but does not verify whether the caller is authorized to edit the target user.

The Excelize Go library before version 2.11.0 has a vulnerability due to missing lower-bound validation when parsing shared-string cell values. A specially crafted XLSX file with a value of -1 can cause an out-of-bounds slice access and panic when read via GetCellValue or GetRows.

The Excelize Go library before version 2.11.0 does not enforce the TotalRows limit on the row r attribute during streaming worksheet reading. An attacker can supply a small XLSX file with a row number above 1048576, causing empty rows to be appended and excessive memory and CPU consumption.

9Router before version 0.5.2 treats loopback requests as trusted and allows /v1/* access without an API key. A same-host reverse proxy forwarding public traffic through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local, enabling a remote unauthenticated attacker to access /v1 APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints.