CVE Vulnerability Catalog

Quasar Framework prior to @quasar/icongenie 6.1.1 allows path traversal in the icongenie generate --profile command. Folder and name values from a user-supplied profile are not constrained to the Quasar project directory, allowing parent-directory traversal. A developer running a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration.

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

LogicalDOC Enterprise up to and including 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing an authenticated user to manipulate SQL queries via a crafted workflow template name.

Bludit CMS 3.22.0 has an issue that allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints.

kkFileView versions 5.0.0 through 5.0.2 contain a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request.

JetBrains TeamCity before 2026.2.1 contains a vulnerability due to missing validation of Git submodule URLs, allowing reading local repositories on the server. Attackers can exploit this to access confidential data.

In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, a Kotlin DSL sandbox escape leading to remote code execution (RCE) on the server was possible. The vulnerability allows an attacker to execute arbitrary code in the context of the TeamCity server.

Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.

In Quasar Framework prior to 2.32.2, the openURL() utility trusted window.SafariViewController whenever that global existed in an iOS environment. Attacker-controlled HTML rendered by components such as QEditor can create a named SafariViewController element, causing browser named-property resolution to replace the expected native bridge object. A later openURL() call then invokes isAvailable() on the element, throws a TypeError, and disrupts external navigation, login redirects, payment redirects, and other URL-opening workflows.

In Payload CMS, the @payloadcms/db-mongodb adapter in versions before 3.87.0 and canary versions before 4.0.0-canary.20 allows an authenticated user who can update a document to modify fields that field-level write access control does not permit them to change. The Postgres and SQLite adapters are not affected.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in an unknown function of the file /opils/admin/view_product.php. Manipulation of the Category argument allows remote attack. The exploit is public.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and stylesheet that execute JavaScript in the Payload origin when a logged-in user opens the file. This leads to JavaScript execution in the victim's browser context.

In Payload CMS, the @payloadcms/storage-s3 package in versions before 3.90.0 and canary versions before 4.0.0-canary.34 allows an authenticated user to overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation.

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to trusted users are less exposed.

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed.

Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

In Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This leads to code execution in the victim's browser.

In Payload CMS versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to an unintended recipient. This issue is fixed in version 3.90.0.

The @payloadcms/plugin-multi-tenant plugin before versions 3.90.0 and canary before 4.0.0-canary.34 by default allows an authenticated user to assign their own account to other tenants. Deployments that replace the default behavior with secured tenants arrayFieldAccess.create and update functions are not affected. Fixed in versions 3.90.0 and 4.0.0-canary.34.