CVE Vulnerability Catalog

A flaw was found in itsourcecode Leave Management System 1.0 in an unknown part of the file /module/department/index.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A vulnerability was detected in 0-Gaurav-0 nexus-mcp version aed0026e7ac1f23dc940e46e9fd3a2da6904f914 in the function child_process.exec of the file src/auth/browser.ts of the nexus_reauth MCP tool component. Manipulation of the argument url results in command injection. The attack can be performed remotely and the exploit is now public.

A weakness was identified in mealie-recipes Mealie up to 3.25.1 in the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the Recipe Action Trigger component. Manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely and the exploit is publicly available.

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls, via crafted IOCTL requests sent to the \Device\wsdk device.

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file path and persuading an administrator to restore the file.

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. This may disable antivirus protection or enable privileged code execution if modified binaries are loaded by an elevated WatchDog process.

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.

A weakness has been identified in SxDevOps versions 1.0 and 1.1 in an unknown function of the file backend/sxdevops/settings.py, leading to information disclosure. The attack can be initiated remotely. A patch named 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available.

The SmartLife app dynamically generates brand-new authentication parameters within its runtime process. With the obtained parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account, and if the account exists, the real backend account ID can also be retrieved.

A vulnerability was found in SxDevOps versions 1.0 and 1.1 in the generate_host_task function of the file backend/aiops/services.py (Command Handler component). Manipulation of the command argument results in command injection, and the attack can be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A vulnerability has been found in SxDevOps versions 1.0 and 1.1 in the paramiko.SSHClient.exec_command function of the file backend/ops/host_tasks.py (TASK_RUN_COMMAND component). Manipulation of the command argument leads to command injection, and the attack may be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint. This allows unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action. This allows attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the plugin issues to any anonymous visitor on request. This allows unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz. This allows a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.