CVE Vulnerability Catalog

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public.

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.

Permission control vulnerability in the memory management module. Successful exploitation of this vulnerability may affect confidentiality.

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, and 10.5.x <= 10.5.12 fail to verify that the token used during code exchange originates from the same authentication flow. This allows an authenticated user to perform account takeover via a crafted email address when switching authentication methods and sending a request to /users/login/sso/code-exchange. It requires ExperimentalEnableAuthenticationTransfer enabled (default) and RequireEmailVerification disabled (default).

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, and 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication. This allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data in the OAuth completion flow. It requires email verification disabled (default), OAuth/OpenID Connect enabled, and the attacker controlling two SSO users, one of whom never logged into Mattermost.

Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to shell command injection attacks. To exploit this, an attacker must log in to the router's administrative portal, which by default is reachable only via LAN ports.

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the 'redirectUrlParameter' value. The application interprets the input string as a Java expression, allowing an unauthenticated attacker to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353.

Motyw Tiger dla WordPressa jest podatny na eskalację uprawnień we wszystkich wersjach do i włącznie z 101.2.1. Problem wynika z braku ograniczeń w pliku 'paypal-submit.php', który pozwala na rejestrację użytkowników z rolą 'administrator'.

Wtyczka Tiare Membership dla WordPressa jest podatna na eskalację uprawnień we wszystkich wersjach do i włącznie z 1.2. Problem wynika z funkcji 'tiare_membership_init_rest_api_register', która nie ogranicza ról użytkowników podczas rejestracji.

Wtyczka FindAll Membership dla WordPressa jest podatna na obejście uwierzytelniania we wszystkich wersjach do i włącznie z 1.0.4. Problem wynika z niewłaściwego logowania użytkownika z danymi wcześniej zweryfikowanymi przez funkcje 'findall_membership_check_facebook_user' oraz 'findall_membership_check_google_user'.

Wtyczka FindAll Listing dla WordPressa jest podatna na eskalację uprawnień we wszystkich wersjach do i włącznie z 1.0.5. Problem wynika z funkcji 'findall_listing_user_registration_additional_params', która nie ogranicza ról użytkowników podczas rejestracji.

The Access Control Bypass vulnerability in ALC WebCTRL and Carrier i-Vu up to and including version 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the web-based building automation server.

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from an XML document to make it pass verification. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error, but affected versions return true when validating an XML file with no signatures.

An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) from version 1.0 through commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.

A vulnerability in imonnit.com (as of 2025-04-24) allows attackers to escalate privileges via a crafted password reset, enabling takeover of arbitrary user accounts.

In classroomio 0.1.13, student accounts can delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.

NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.

Zenitel TCIV-3+ jest podatny na refleksyjną podatność typu cross-site scripting, która może umożliwić zdalnemu atakującemu wykonanie dowolnego kodu JavaScript w przeglądarce ofiary.

Istnieje podatność na wstrzykiwanie poleceń systemowych z powodu niekompletnej walidacji danych wejściowych dostarczonych przez użytkownika. Niewystarczające zasady formatowania mogą umożliwić atakującym dodawanie dowolnych danych.