CVE Vulnerability Catalog

MCPHub prior to version 1.0.29 has a flaw in the PUT /api/system-config endpoint (handler updateSystemConfig) that performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter, but never inspects req.user.isAdmin.

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. It affects an unknown function in the file dist/service-worker.production-esm.js of the Google OAuth Client Secret component. Such manipulation leads to hard-coded credentials. The attack can be executed remotely, and the exploit is publicly available.

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

A vulnerability was found in ieungSoft Ultra RAMDisk Pro 1.82 in the kernel driver URDSCSI.sys. Manipulation leads to improper privilege management. The attack requires local access, and the exploit has been publicly disclosed.

The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings affecting confidentiality, integrity, or availability.

The Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump via the publicly exposed `kbd_cron_process` parameter. Attackers can predict the dump filename and download the backup from the public uploads directory.

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to remove URL filtering rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 allows unauthenticated attackers to delete port-forwarding rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

A vulnerability was detected in NASA earthdata-search 1.0.0 in the scaleImage function. Manipulation results in server-side request forgery (SSRF). The attack can be initiated remotely, and the exploit is public.

A SQL injection vulnerability was found in code-projects Online Shopping System 1.0 in the search functionality. Manipulation of the keyword argument allows remote attack. The exploit has been publicly disclosed.

In the zbus_polkit crate before 5.1.0, Subject::new_for_owner() encodes the uid as unsigned 32-bit, while the polkit interface expects signed 32-bit. This mismatch causes polkit to ignore the supplied UID and determine the owner itself via PID, leading to a TOCTOU race. A local attacker can exploit this to bypass polkit authorization and perform unauthorized actions.

The ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability. Attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler, achieving PHP code execution as the web-server user.

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 allows unauthenticated attackers to alter dynamic DNS state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 allows unauthenticated attackers to add or change static DHCP rules via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via a crafted POST request to /cgi-bin/cstecgi.cgi.

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools did not check if the file path was within the workspace. Relative, absolute, or ~-expanded paths could write or delete files outside the workspace with backend user privileges. This can escalate to code execution.

In Helix Ultimate for Joomla before 2.2.10, a privileged file upload bypass via content spoofing was found. Previously only file extension and basic size were validated, allowing non-image files with raster extensions to be uploaded. Strict MIME verification and GD binary raster decoding were added to reject invalid images.

In Helix Ultimate for Joomla before 2.2.10, a stored XSS vulnerability was found in the MegaMenu layout. Unsanitized column and item configuration values were rendered without complete contextual escaping, allowing injection of malicious HTML/JS. Stricter sanitization and tag allowlists were implemented.

In Joomla extensions from miniOrange, a missing authentication check allows unauthenticated attackers to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.

In SmallRye GraphQL, the number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can send a GraphQL query with a large exponent float literal, leading to allocation of extremely large BigInteger objects, causing CPU exhaustion or OutOfMemoryError, resulting in denial of service.