CVE Vulnerability Catalog

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts the value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when opened, could lead to arbitrary code execution or a crash.

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

An incorrect authorization vulnerability in Apache Syncope stems from flawed implementation of Realm hierarchy-based checks. Permission enforcement uses prefix matching, making it impossible to correctly distinguish between two sibling Realms whose names begin with the same string, leading to unauthorized access.

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

LangBot's plugin runtime (pip package langbot_plugin) through version 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 with authentication based on a key that defaults to an empty string and is never set. A remote attacker can register an arbitrary 'debug plugin' without credentials, receive full context of IM messages, inject forged replies, send messages as bots, read knowledge bases, and register malicious tools.

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys, inject attacker-controlled values, or delete stored licenses entirely.

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling. CoreUpgradeController and BackupService concatenate the user-supplied backup_file/filename value directly onto the backup directory path without normalization, without basename(), and without verifying the resolved path stays inside storage/app/core-backups. An authenticated user with only settings.edit permission can use ../ sequences to delete arbitrary files or restore a ZIP archive from an arbitrary location, leading to remote code execution.

File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile and the failure-cleanup path calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is not gated by Perm.Delete or the checkDescendants rule, so an authenticated non-administrator with default Create and Modify permissions can delete directories they are not authorized to delete.

A vulnerability was detected in marcobambini Gravity up to 0.9.7 in an unknown function of src/utils/gravity_json.c, within the UDP JSON parser component. Manipulation leads to an integer overflow. The attack can be performed remotely and the exploit has been publicly disclosed. Upgrading to version 0.9.8 mitigates the issue.

A vulnerability in Apache Syncope that involves insertion of sensitive information into sent data. Any authenticated user can query the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the caller's entitlements.

A vulnerability in Apache Syncope allows an administrator with adequate entitlements to access via REST the list of existing Access Tokens, including their signed JWT body. These tokens can then be used for further REST requests, impersonating users with higher administration privileges.

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — including virtual users without SSH access who can upload PHP/CGI scripts — can read the file and obtain the Froxlor database credentials. Database access can then be leveraged to alter an administrator's password hash and TOTP seed, log in as a Froxlor administrator, and ultimately gain root privileges. Only instances configured to use pure-ftpd are affected.

A vulnerability was found in taisan tarzan-cms 1.0.0 in the openConnection function of com/tarzan/cms/modules/admin/service/biz/ThemeService.java, within the theme download component. Manipulating the httpUrl argument leads to server-side request forgery (SSRF). The exploit has been publicly disclosed and the project has not yet responded to the issue report.

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during playbook run creation, allowing an authenticated channel member to add an arbitrary user to a restricted channel via the run owner field. Mattermost Advisory ID: MMSA-2026-00677

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.