CVE Vulnerability Catalog

Podatność CVE-2025-64121 w kontrolerze Multi-Stack (MSC) firmy Nuvation Energy umożliwia obejście uwierzytelniania poprzez alternatywną ścieżkę lub kanał. Problem ten dotyczy wersji kontrolera MSC od 2.3.8 do przed 2.5.1.

A vulnerability in Nuvation Battery Management System allows Authentication Bypass. This issue affects Battery Management System: through 2.3.9.

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints (`/install/api/*`) are directly accessible and exploitable without any authentication. An attacker can bypass the Ib installer entirely by calling the API endpoints directly. This allows any unauthenticated attacker to create admin accounts, modify application configurations, and potentially overwrite existing data. Version 2.3.10 fixes the issue.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

AdonisJS has a Path Traversal vulnerability in multipart file handling, allowing a remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This impacts @adonisjs/bodyparser through version 10.1.1 and 11.x prerelease versions prior to 11.0.0-next.6.

Emlog version 2.5.23 has a CSRF vulnerability in article creation functionality. This can lead to a user being forced to post an article with arbitrary, attacker-controlled content. When combined with stored XSS, it leads to account takeover.

In gpsd before commit dc966aa, a heap-based out-of-bounds write vulnerability exists in the drivers/driver_nmea2000.c file. The hnd_129540 function, handling NMEA2000 PGN 129540 packets, fails to validate the user-supplied satellite count against the skyview array size (184 elements). An attacker can provide a satellite count up to 255, causing a write beyond the array bounds, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

An SQL injection vulnerability has been reported in Hyper Data Protector. Remote attackers can exploit it to execute unauthorized code or commands. The vulnerability is fixed in version 2.2.4.1 and later.

An improper control of generation of code vulnerability has been reported in Malware Remover. Remote attackers can exploit it to bypass protection mechanisms. The vulnerability is fixed in version 6.6.8.20251023 and later.

SQL injection vulnerability in online-movie-booking in movie_details.php allows attackers to gain sensitive information.

Wtyczka Branda dla WordPressa jest podatna na eskalację uprawnień poprzez przejęcie konta we wszystkich wersjach do i włącznie z 3.4.24. Problem wynika z niewłaściwej weryfikacji tożsamości użytkownika przed aktualizacją hasła.

Signal K Server before version 2.19.0 contains two vulnerabilities that can be chained to steal JWT tokens without any authentication. The first is unauthenticated WebSocket request enumeration via the serverevents=all parameter, and the second is unauthenticated polling of access request status, which returns the JWT token in plaintext after an administrator approves the request.

Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.

Titra is open source project time tracking software. Prior to version 0.99.49, any authenticated Admin user can modify the timeEntryRule in the database. The value is then passed to a NodeVM to execute as code. Without sanitization, it leads to Remote Code Execution. Version 0.99.49 fixes the issue.

RAGFlow is an open-source RAG engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta token generation process allows these tokens to be mutually derivable. Both tokens are generated using the same `URLSafeTimedSerializer` with predictable inputs, enabling an unauthorized user who obtains the shared assistant/agent URL to derive the personal API key. This grants full control over the assistant/agent owner's account. Version 0.22.0 fixes the issue.

A stack-based buffer overflow exists in libcoap versions up to 4.3.5 (before commit 30db3ea) during address resolution. A remote attacker can trigger a crash or potentially achieve remote code execution if proxy logic is enabled in the application.

Ksenia Security lares (model starszy) w wersji 1.6 zawiera krytyczną lukę bezpieczeństwa, która ujawnia PIN systemu alarmowego w pliku XML 'basisInfo' po uwierzytelnieniu. Atakujący mogą uzyskać PIN z odpowiedzi serwera, co pozwala na ominięcie zabezpieczeń i dezaktywację systemu alarmowego bez dodatkowego uwierzytelnienia.

Model Ksenia Security lares (legacy) systemu automatyki domowej w wersji 1.6 zawiera podatność na niechroniony punkt końcowy, który pozwala uwierzytelnionym atakującym na przesyłanie binarnych obrazów systemu plików MPFS. Atakujący mogą wykorzystać tę podatność do nadpisania pamięci programu flash i potencjalnego wykonania dowolnego kodu na serwerze WWW systemu automatyki domowej.