CVE Vulnerability Catalog

In FOSSBilling versions 0.5.6 through 0.7.2, when a client requests a password reset multiple times, the system reuses the existing token instead of generating a new one, with the 15-minute validity anchored to the first request. An attacker who obtained the original reset link can still use it even after the victim requests a new reset, as the original token is never invalidated.

FOSSBilling prior to version 0.8.0 contains a vulnerability that allows a low-privileged staff account to escalate privileges via the admin API. A user with the `staff.create_and_edit_staff` permission can call `/api/admin/staff/permissions_update` for their own account and set any permissions, bypassing role-based access control.

FOSSBilling versions 0.5.3 through 0.7.2 allow authenticated clients to read and reset API key secrets for orders that are no longer active (e.g., suspended, canceled). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper existing in the `Serviceapikey` module and the frontend UI correctly gating access on active orders.

FOSSBilling versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag and insufficient permission checks or unsafe parameter handling on individual endpoints.

FOSSBilling versions 0.6.10 through 0.7.2 contain a PHP code injection vulnerability in the Config::prettyPrintArrayToPHP() method. An attacker with admin privileges can inject arbitrary PHP code into config.php, which is executed on every HTTP request.

In FOSSBilling prior to version 0.8.0, suspending or deactivating an account does not invalidate existing authenticated sessions. The session loader does not check the account status, allowing a suspended user to retain full access until session expiry.

In Coolify from version 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host.

Coolify prior to version 4.0.0-beta.474 contains a command injection vulnerability in the PostgreSQL healthcheck command generation. An authenticated attacker can exploit attacker-controlled database settings (postgres_user and postgres_db) to inject arbitrary commands executed in the database container.

In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.

In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability exists in the GetLogs Livewire component. Users with team membership (lowest privilege member role) can execute arbitrary commands as root on managed servers.

In Coolify prior to version 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume. This allows an authenticated user who can add file storage to execute commands when the storage is saved.

Leantime has an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

The Users::getUser method in Leantime's JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

Crawl4AI before version 0.9.0 has an SSRF vulnerability in the Docker API streaming path. An unauthenticated remote client can send a POST request to /crawl/stream or /crawl with stream=true, pointing to an internal, private, or link-local address, and the server fetches and streams the response.

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

A vulnerability in the vLLM inference engine before version 0.24.0 allows an attacker to perform a DoS attack by sending a malicious regular expression to the structured_outputs.regex parameter. The expression, lacking compilation timeout and complexity analysis, causes state-space explosion in the grammar compiler, leading to inference worker hang.

Traefik versions 3.7.0 through 3.7.5 have a vulnerability in the Kubernetes Gateway API provider where two accepted HTTPRoutes targeting the same backend Service:port but with different backendRef filters may apply only one route's filter set to all requests reaching that backend. An attacker can impose their filter context on another route's requests, potentially crossing namespace boundaries.

In vLLM before version 0.24.0, a crafted speculative decoding request can cause the rejection sampler to produce a token outside the model vocabulary. This triggers a GPU device-side assertion crash in the engine worker, aborting all concurrent requests.

In FOSSBilling prior to version 0.8.0, the Guest API invoice/update endpoint lacks an authorization check, allowing an unauthenticated user with knowledge of an invoice hash to modify the payment gateway for an unpaid invoice. An attacker who obtains the hash (e.g., via shared URLs, referrer headers, or email links) can change the `gateway_id` to any configured payment gateway.

Memory corruption occurs when processing asynchronous input parameters due to improper handling of modified values between check and use.