CVE Vulnerability Catalog

Tina (headless CMS) versions prior to 3.0.0 — @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and interpolates the raw value into the API URL and JavaScript string literals in generated code. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The issue is fixed in version 3.0.0.

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.

Jexactyl versions prior to 4.0.5 — the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. An authenticated client can complete a lower-value or mismatched-currency payment and cause the order to be processed. The issue is fixed in version 4.0.5.

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.

Contao from version 4.0.0 to 5.3.50 and 5.7.12 has a CSRF vulnerability because RequestTokenListener validates the token only for POST requests, and the GET guard runs only when an act parameter is present. Backend actions via the key parameter can execute without a CSRF token when an authenticated user loads a malicious URL. Fixed in versions 5.3.50 and 5.7.12.

iStoreOS in version istoreos-24.10.7 and earlier has a vulnerability that allows a remote attacker to execute arbitrary code via the task_id parameter in tasks-lib.lua.

In versions from 4.0.0 until 5.3.50 and 5.7.12, Contao (an Open Source CMS) renders comment email or website metadata without sufficient attribute and URL encoding in listComments(). An unauthenticated visitor can submit a comment with malicious script that executes in the backend context when a user opens the Comments module. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 5.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ImagesController that joins the user-controlled {path} parameter to the image target directory without verifying the canonical path stays within that directory. An unauthenticated attacker can use encoded parent-directory segments to access files under the project directory if their extensions are allowed. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.1.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleRegistration::compile() that allows the follow-up registration branch to be entered on any POST to a page with the registration module without verifying FORM_SUBMIT or the captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to send repeated activation emails and determine if a pending registration exists. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleSearch that can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. This issue is fixed in versions 5.3.50 and 5.7.12.

This CVE number has been rejected and should not be used. It is a reservation duplicate of CVE-2026-73364. All references and descriptions have been removed to prevent accidental usage.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

Rocket Software Rocket Remote Desktop version 18.0.8583.1 is vulnerable to insufficiently protected credentials. This means that authentication data may be stored or transmitted without adequate protection.

OpENer v2.3/commit 76b95cf contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

OpENer v2.3/commit 76b95cf contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

OpENer v2.3 (commit 76b95cf) contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.