CVE Vulnerability Catalog

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present sitemap.xml.html template's annee criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the alea_ephemere secret used to sign SPIP action nonces.

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.

Dolibarr versions 23.0.4 before 24.0.1 contain an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files by supplying a crafted hashp parameter value. Attackers can use hashp=shared to skip token validation and access logs, business documents, database backups, and files belonging to other entities.

An OS Command Injection vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software. The product does not properly neutralize special elements used in OS commands. This issue affects versions before 1.0.5.

A use-after-free vulnerability in Microsoft Edge (Chromium-based). An authorized attacker can execute code over a network. The vulnerability is remotely exploitable.

A vulnerability in jackson-databind allows XML datatype deserializers (Duration, XMLGregorianCalendar) to pass raw JSON strings directly to BigInteger/BigDecimal constructors, which are quadratic in digit count. Because the digits are inside a string token rather than a number token, the StreamReadConstraints.maxNumberLength guard does not apply, enabling an attacker to cause excessive CPU consumption with a single request.

An incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software. It allows privilege escalation. This issue affects versions before 1.0.5.

An OS Command Injection vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair. The product does not properly neutralize special elements used in OS commands. This issue affects versions before 1.0.8.

An integer overflow in pitch and buffer-size computation in Orthanc DICOM Server leads to a heap out-of-bounds write when decoding an attacker-supplied PNG. This could result in arbitrary code execution or a service crash.

Puppet Enterprise versions 2023.8.0-2023.8.10 and 2025.0.0-2025.11.2 contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can execute arbitrary shell commands with root privileges.

A vulnerability in NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allows an authenticated user to execute arbitrary SQL through a Database Connector API. This could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions. This allows XXE injection, enabling data exfiltration and denial-of-service attacks.

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set. This allows XXE injection, enabling data exfiltration and denial-of-service attacks.

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The device ships from the factory with a pre-configured low-privilege local user account intended for field technicians, which provides the initial access required to exploit this vulnerability without obtaining or brute-forcing additional credentials.

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions) and has been fixed as a security patch in the latest release of supported versions.

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the interaction between traj_server, poscmd_2_odom, and the EGOReplanFSM emergency recovery logic.