CVE Vulnerability Catalog

An information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version 1.3.2-2809). A specially crafted HTTP request can lead to an information leak, and an attacker can trigger this vulnerability with an unauthenticated HTTP request.

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_SETTINGS permission can set a notice containing an arbitrary script (PUT /api/preloginnotice), resulting in stored cross-site scripting on the login page; unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or Everyone.

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first name, last name and email address) within the same institution.

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting; unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

A vulnerability was detected in nibabel up to 5.4.2 in the array_from_file function of nibabel/volumeutils.py within the Header Handler component. Manipulation leads to uncontrolled memory allocation, and the attack can be carried out remotely. A pull request fixing the issue awaits acceptance.

A weakness was identified in meshio up to 5.3.5 in an unknown function of meshio/_vtk_42.py within the VTK Reader component. Manipulating the DIMENSIONS argument can lead to uncontrolled memory allocation, and the attack can be executed remotely. The project was informed early via an issue report but has not responded yet.

A security flaw was discovered in feedfinder2 up to 0.0.4 affecting the find_feeds function in feedfinder2.py. Manipulation results in server-side request forgery, and remote exploitation is possible. The project was informed early via an issue report but has not responded yet.

In Open Object from 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET /api/v2/objects/{uuid}/{index}. The history_detail action calls get_queryset() and get_object_or_404 directly, bypassing object permission checks. This is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.

In Domoticz prior to 2026.3, the udevices JSON command handler (Cmd_UpdateDevices in main/WebServerCmds.cpp) performed no session.rights check before invoking a Lua parser script. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input via GET /json.htm, and the script parameter lacked a path-traversal guard. Execution is limited to already-installed valid Lua files, and the issue is addressed in version 2026.3.

In InvoicePlane prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve() and reject() methods in the Guest Quotes controller call approve_quote_by_id() and reject_quote_by_id() without the where_in('ip_quotes.client_id', $this->user_clients) scoping, and generate_pdf() calls mark_viewed() before checking client scope. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable 1.7.2.

A security flaw was discovered in MusicFreeDesktop 0.0.6/0.0.7/0.0.8 in an unknown function of the Request Forwarder component. Manipulation results in information disclosure, and the attack can only be performed from the local network. The exploit has been publicly released and may be used for attacks, and the project was informed early via an issue report but has not responded yet.

A vulnerability was identified in MusicFreeDesktop 0.0.6/0.0.7/0.0.8 in an unknown function of the Request Forwarder component. Manipulation leads to server-side request forgery, and remote exploitation is possible. The exploit is publicly available and might be used; the patch identifier is b0d3876247a0a64fa0e430e4b21870e41f503182.

Prior to 8.1.0, AVideo's view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not covered by the objects/security.php filter lists, and the Login::canUpload() capability can be self-granted, allowing an attacker to store an HTML title whose event handler runs in a privileged viewer's browser (an administrator or an operator on the attacker's streamer).

Prior to 8.1.0, AVideo's anonymous login interface reflects request values into HTML and JavaScript without output encoding. webSiteRootURL is returned verbatim by Streamer::getStreamerURL() and reaches navigation and form attributes as well as a JavaScript string in view/index.header.php, while the user and pass fields are filtered only for single quotes, allowing double quotes and angle brackets to break out of HTML attributes. Additionally, view/index.header.php reflects POST fields using json_encode without JSON_HEX_TAG, and locale/function.php stores the POST lang value in the session for unescaped reflection.

Prior to 1.40.0, Blombooru's administrator-only GET /proxy-image endpoint, exposed as /api/booru-import/proxy-image, accepts a url query parameter and fetches it server-side without meaningful destination validation. proxy_image() only checks whether the value starts with http, then uses get_client_for_url or requests.get and streams the response; private, loopback, and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address.

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.