CVE Vulnerability Catalog

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a company or silently add a compromised email account to a company. Version 3.0.1 fixes the issue.

PJSIP before commit 4472a31 has a stack buffer overflow in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. An overly long command line can overflow fixed-size buffers, potentially causing application termination. Only applications with the telnet CLI front-end enabled are affected.

In the PJSIP library before commit 628b716, there is a stack buffer overflow in the telnet CLI front-end (handle_up_down() in cli_telnet.c) when redrawing the command line during history recall. This affects only applications with the telnet CLI enabled and may lead to application termination. Exploitation requires access to the unauthenticated telnet CLI, which already permits arbitrary CLI commands, so the additional impact is limited.

PJSIP prior to commit 8d5956a has a heap buffer overflow in the PJLIB-UTIL HTTP client when buffering an HTTP response body. An incorrect size calculation based on Content-Length can cause data to be written past the end of the buffer.

In the PJSIP library before commit d6a0e7f, there is a buffer overflow in pjsip_generic_array_hdr_print() in sip_msg.c, which serializes generic array headers (e.g., Allow, Require, Supported). Under certain output-buffer boundary conditions, the function can write one byte past the end of the buffer. This is reachable mainly in applications that parse and re-serialize incoming SIP requests, such as proxies, SBCs, or B2BUAs.

Admidio up to version 5.0.11 has a CSRF vulnerability in modules/plugins.php, where plugin installation, uninstallation, and update operations are performed via GET requests without CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, triggers arbitrary plugin operations, including uninstallation, which executes DROP TABLE SQL scripts and destroys plugin data.

Emlog up to version 2.6.29 has a vulnerability in the emUnZip() function, which extracts ZIP entries without validating paths for ../ traversal sequences. An attacker can overwrite arbitrary files on the server, including config.php, leading to immediate remote code execution (RCE). At the time of publication, there are no publicly known patches.

Emlog before version 2.6.16 has a blind SQL injection vulnerability in User_Model::getUserDataByLogin(). The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie validation path, where $username is extracted from the cookie and passed unfiltered into SQL — guarded only by an HMAC signature that requires AUTH_KEY to forge.

In the undici library versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2, the retry handler can leave an already-exposed response body pending forever. When a server returns a response with Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards the new response but the original response body is never ended or destroyed, causing reads on that body to never settle and the body timeout not to fire.

undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, including its error listener, while that stream can still emit. When a remote peer sends a compressed payload that crosses the built-in 128 MiB decompressed-payload limit and then contains a malformed DEFLATE byte, the inflate stream emits a data error with no listener attached, which Node.js treats as a fatal unhandled error and terminates the entire process. Exploitation is remote and unauthenticated, requires no application mistake, and is asymmetric, since roughly 130 KB on the wire expands past the limit and crashes the process, and reconnecting can repeat the crash.

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writable stream unconditionally and discards the returned promise, but per the WHATWG Streams standard aborting a locked writable returns a promise that rejects with a TypeError. Because the application holds a writer on that writable, which is the only way to write, the rejection is never observed and Node's default unhandled-rejection behavior terminates the process. An untrusted server can therefore crash a client with a single abrupt disconnect, with no authentication and no application mistake. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

A Cross-Site Scripting (XSS) vulnerability in Netgate pfSense Plus software versions <= 26.03 and pfSense CE software versions <= 2.8.1 exists in the captive_portal_status.widget.php file. A remote attacker can exploit this to execute arbitrary code in the victim's browser.

A Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a server-side request forgery (SSRF) vulnerability. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM Langflow OSS versions 1.0.0 through 1.10.2 have an improper authorization vulnerability. A remote authenticated attacker could obtain sensitive information and inject messages into workflow history.