CVE Vulnerability Catalog

A security flaw in zevorn rt-claw up to version 0.2.0 affects the tool_run_script_execute function in claw/services/tools/script.c. Input manipulation allows remote code injection. The exploit has been publicly released and may be used in attacks.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/services/tools/net.c of the http_request component. Data manipulation leads to information disclosure. The attack can be executed remotely and the exploit has been made public.

A vulnerability has been found in GoClaw up to version 3.13.3-beta.3 in the ExecTool.Execute function of the goclaw/internal/tools/credentialed_exec.go file. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.

A vulnerability in Sipeed PicoClaw up to version 0.2.9 in the file web/backend/middleware/access_control.go allows authentication bypass by manipulating the allowed_cidrs argument. The attack is remote but requires high complexity and is difficult to exploit. The exploit is publicly available.

A security vulnerability was found in Sipeed PicoClaw up to version 0.2.9. The issue is in the handleMessageReceive function in the file pkg/channels/feishu/feishu_64.go of the Group Message Handler component, leading to missing authorization. The attack can be launched remotely and the exploit has been publicly disclosed.

A weakness in the web_fetch component of Sipeed PicoClaw up to version 0.2.9 allows server-side request forgery (SSRF). The attack can be performed remotely, and the exploit is publicly available.

A security flaw was discovered in Sipeed PicoClaw up to version 0.2.9 in the dispatchIncoming function of the file pkg/channels/wecom/wecom.go in the Group Message Handler component. The issue involves incorrect authorization, allowing remote exploitation. The exploit has been publicly released and may be used in attacks.

A server-side request forgery (SSRF) vulnerability was found in zhayujie CowAgent up to version 2.1.1 in the WebFetch.execute function of agent/tools/web_fetch/web_fetch.py. The attack can be performed remotely by manipulating the url argument, and the exploit has been publicly disclosed.

The Flow Payment plugin for WordPress version 3.0.8 is vulnerable to reflected XSS on the WooCommerce checkout page. The error_message parameter is passed unsanitized to wc_add_notice(), allowing an unauthenticated attacker to execute JavaScript in the victim's browser.

Stored XSS vulnerability in the POST /api/prompts/share endpoint in parisneo/lollms (latest version). An attacker can store malicious JavaScript in a message, which executes in the victim's browser when opened, enabling data theft and account takeover.

Stoat Android app exposes ShareTargetActivity component that accepts a URI from SEND intent. It does not validate the URI, so an attacker can pass a file:// URI pointing to internal app files (e.g., database, tokens). The victim may unknowingly send these files to the attacker.

A vulnerability was found in CartoDB carto-api-client version 0.5.29 in the addFilter function of src/filters.ts. Manipulation of the column argument leads to improperly controlled modification of object prototype attributes. The attack can be executed remotely.

A vulnerability was found in Inputmask up to version 5.0.9, involving uncontrolled modification of object prototype attributes in the extendDefaults/extendDefinitions/extendAliases functions. The issue resides in lib/dependencyLibs/extend.js and can be exploited remotely.

A command injection vulnerability was found in LiuMengxuan04 MiniCode 0.1.0 in the child_process.spawn function of mcp.ts. The attack can be launched remotely but requires high complexity.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /prescriptionrecord.php file. An attacker can remotely manipulate the delid argument, leading to SQL injection. The exploit has been made public, increasing the risk of attacks.

A vulnerability was found in the write_file component of nearai ironclaw up to version 0.29.1, involving a link following issue in the validate_path function within src/tools/builtin/path_utils.rs. Local access is required, and the exploit is publicly available.

In princezuda SafestClaw up to version 4.2.4, a vulnerability was found in the ShellAction._validate_command function in src/safestclaw/actions/shell.py. Manipulation leads to an incomplete blacklist, allowing local bypass of security controls.

A security vulnerability was found in GoClaw up to version 3.15.0-beta.32, allowing SSRF attacks via the CheckSSRF/isPrivateIP function in internal/tools/web_shared.go. The attack can be launched remotely and the exploit has been publicly disclosed.

In GoClaw up to version 3.13.2, the function ToolsInvokeHandler.ServeHTTP in file internal/http/tools_invoke.go lacks authorization. The attack can be performed remotely, and the exploit is publicly available.

A security flaw in GoClaw up to version 3.13.2 affects the extractBin/RequestApproval/matchesAllowlist function in internal/tools/exec_approval.go, causing incorrect authorization. A public exploit is available, enabling attacks.