CVE Vulnerability Catalog

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.

Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to inject arbitrary emails into the CRM inbox. Attackers can supply crafted RFC 2822 messages with forged sender information and headers to insert emails with any subject and body, including replies to existing conversation threads.

A flaw was found in online-clinic-management-system in doctorlogin.php, where manipulation of the doc_mail/doc_pswd arguments leads to SQL injection. The attack can be executed remotely and a public exploit may already be in use. The project was notified but has not responded.

In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface FIFOs under a predictable path derived from the agent name and a hash of the workload configuration. If the path already exists at agent startup, it is reused without validating owner or permissions, allowing a local user to impersonate the workload and modify cluster state.

A double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

A race condition due to improper synchronization of a shared resource in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

In the blaze Scala library prior to 0.23.18 and from 1.0.0-M1 to 1.0.0-M42, the hand-written HTTP/1.1 parser accepts invalid header names, obsolete folded lines, unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests with both Transfer-Encoding and Content-Length. Parser disagreement with a fronting intermediary can enable authorization bypass, response-queue poisoning, or cache poisoning.

In the Pay library (Ruby on Rails) prior to 11.6.2, Pay::Webhooks::PaddleBillingController compares the SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using String#==, allowing an attacker to recover a valid signature via timing measurements. A forged webhook can alter billing state, provision paid features, or trigger notifications.

In DotVVM prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route with multiple unconstrained parameters in one path segment can cause excessive regex backtracking in DotvvmRoute.IsMatch when a long near-match path is supplied. The lack of a matching timeout in DotvvmRouteParser.RouteRegex leads to resource exhaustion.

In LangChain MongoDB integrations prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), alist(), and MongoDBStore.search() incorporate filter dictionaries into MongoDB queries without rejecting keys prefixed with $. An authenticated caller controlling a filter can inject MongoDB operators such as $regex or $where, bypassing tenant isolation.

In flat-to-nested prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent fields as keys in temp and pendingChildOf objects. When parent or id is __proto__, prototype pollution occurs, potentially causing application-logic corruption, denial of service, or further exploitation.

In Flask-Reuploaded from 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) applies lowercase_ext to the default path but uses the case-preserving extension helper for a caller-supplied name before extension_allowed evaluates an AllExcept denylist. An attacker can bypass a lowercase denylist with a mixed-case dangerous extension and store the file in the served upload directory.

In backpack/crud before 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest builds a shell command with a URL influenced by the HTTP Host header and passes it to exec() without adequate shell neutralization. An unauthenticated attacker can inject OS commands when exec() and curl are available and the 1-in-100 random gate is reached (repeated requests can hit it). Successful exploitation executes commands as the web-server user.

In backpack/crud from 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query instead of the query configured through addClause() or addBaseClause(). An authenticated user who knows or guesses an out-of-scope record primary key can modify, delete, or reorder records hidden by tenant, ownership, or other row-level access-control scopes.

In backpack/crud before 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk trusts disk-relative paths from clear_<attribute>[] and passes them to Storage::disk()->delete without confirming that the paths are persisted on the current model record. An authenticated user with Update access to a CRUD using this mutator can delete another record's attachment, a shared asset, or another operational file on the configured disk.

In backpack/crud before 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm passes request data from $request->except(['_token']) to the user model instead of restricting updates to fields accepted by AccountInfoRequest::validationData(). An attacker with an authenticated Backpack session can mass-assign password, the authentication column, or other deployment-specific fillable attributes.

In EasyAdmin from 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin.