CVE Vulnerability Catalog

Cross Site Scripting (XSS) vulnerability in fuint Member Marketing System version <=1.0. A remote attacker can exploit the ClientMessageController.java file to execute arbitrary JavaScript code in the victim's browser.

Shamefile before version 0.1.7 has a path traversal vulnerability in the `shame next` command. A malicious shamefile.yaml can disclose contents of files outside the repository, one line at a time, to the user's terminal.

In ClearanceKit before version 5.0.10, the ECDSA key used to sign the policy database is stored in the macOS keychain without ACL restrictions. Any root process can use this key to sign arbitrary policy content.

In ClearanceKit before version 5.0.10, ECDSA signatures for SQLite database tables lack a version counter or freshness binding. An attacker can replace the database and signatures with an older, legitimately signed version, which will be accepted by the system.

Vulnerability in nono software before version 0.55.0, allowing sandbox escape via access to local Unix domain sockets (including abstract). An attacker can communicate with systemd dbus.

The Spectra Gutenberg Blocks plugin for WordPress up to version 2.19.28 is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.

In @ai-sdk/harness-opencode before version 1.0.28, the relay authorizes requests based on the script path in the command line. Untrusted code in the sandbox can invoke arbitrary host tools, including secret access and cloud operations.

The `@ai-sdk/harness-opencode` tool before version 1.0.29 authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code in the sandbox to invoke host-exposed tools, including secret lookups, deployment operations, and cloud API calls, without a corresponding model-authorized tool-call event.

Vulnerability in Apache MINA SSHD (sshd-git component) allows an authenticated SSH user to execute arbitrary JGit commands, including writing files to arbitrary locations via `git archive --output`.

Paymenter versions prior to 1.5.5 have a race condition in the credit payment implementation. The row lock (lockForUpdate()) is executed outside an active database transaction, making it ineffective in MySQL/MariaDB. Concurrent payment requests can read the same credit balance and reuse the same funds.

FreeScout, a free help desk built with Laravel, does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.

FreeScout prior to version 1.8.224 has a vulnerability in the App Logs feature that allows an authenticated attacker to download arbitrary server-local files readable by the PHP process via manipulation of the dl parameter.

In Paymenter prior to version 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request.

Paymenter before version 1.5.0 fails to invalidate the email verification state after an email change. A verified account retains its verified status even after switching to an unverified address. This could lead to abuse of features gated behind verified status.

Paymenter is a free open-source webshop solution for hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations. This value is passed directly into a server-side HTTP request via file_get_contents without allowlist, validation, or signature verification. The vulnerability allows remote unauthenticated attackers to trigger HTTP GET requests to arbitrary external or internal endpoints, potentially leading to blind SSRF and access to internal network services.

A Prototype Pollution vulnerability in the getQueryParam function in /public/js/main.js in FreeScout. The fix in version 1.8.139 is incomplete, allowing attacks via nested URL keys. Fixed in version 1.8.223.

RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 contain a reflected XSS vulnerability. An attacker can trick an authenticated user into visiting a crafted URL, executing arbitrary JavaScript in their session.

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting (XSS) vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it.

Vulnerability in cal.diy up to version 6.2.0. Open redirect in the conferencing OAuth callback endpoint. Attackers can redirect users to arbitrary URLs via a malicious state parameter.

HyperDX before version 2.31.0 contains a server-side request forgery (SSRF) vulnerability. Authenticated team members can direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.