CVE Vulnerability Catalog

The mcp-security library in Spring AI prior to version 0.1.9 fails to implement mandatory SSRF mitigations, processing untrusted URLs for OAuth discovery without verifying if targets are malicious or internal. This only affects installations with Dynamic Client Registration (DCR) enabled.

Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module, allowing remote attackers to upload arbitrary files and achieve remote code execution. The vulnerability is due to insufficient validation of uploaded file types and executable content.

A stack-based buffer overflow vulnerability was found in the TRENDnet TEW-432BRP firmware version 3.10B20, specifically in the formWPS function of the /goform/formWPS file. Remote manipulation of the peerPin argument triggers the overflow. The vendor states the product has been end-of-life for 15 years and will not be fixed.

A stack-based buffer overflow vulnerability was found in the TRENDnet TEW-432BRP firmware version 3.10B20, specifically in the formSetRoute function of the /goform/formSetRoute file. An attacker can remotely manipulate the ip/mask/gateway arguments to trigger the overflow. The exploit has been publicly disclosed and may be used.

The form-data-objectizer library before version 1.0.1 is vulnerable to prototype pollution via processing bracket-notation form keys (e.g. name[sub]). An attacker can send a form field with a name starting with __proto__, causing mutation of Object.prototype and affecting the entire Node.js process.

In n8n-MCP prior to 2.51.2, when ENABLE_MULTI_TENANT=true, HTTP requests without x-n8n-url or x-n8n-key headers silently fell back to the operator's credentials, allowing an authenticated MCP tenant to execute n8n management calls against the operator's instance instead of its own.

In asn1c version 1.4 and earlier, a memory safety vulnerability was found in the generated OER decoding code for INTEGER type. When parsing a maliciously crafted zero-length OER payload for a variable-length non-negative INTEGER, the decoder fails to validate required bytes before extracting the Most Significant Bit, causing a precise 1-byte Heap Out-of-Bounds Read.

In AVideo 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.

Roslyn CodeLens MCP Server versions 0.0.9 through 1.17.0 contain a vulnerability where the get_diagnostics MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the solution without any allowlist, signature check, or user confirmation. An attacker can place a malicious .csproj referencing an attacker-controlled DLL in a location the victim opens with the MCP server, leading to arbitrary code execution with the server's OS privileges.

Home Assistant Companion apps for iOS and Android expose a JavaScript bridge to the in-app WebView that is vulnerable to cross-origin iframe attacks. This flaw allows arbitrary JavaScript execution in the main-frame origin of the Home Assistant frontend and exfiltration of the signed-in user's access token.

In FreePBX prior to versions 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs.

The CDR Reports module in FreePBX before versions 16.0.50 and 17.0.11 contains an SQL injection vulnerability via the 'order' and 'sort' POST parameters. Authentication with a CDR section access account is required, but full admin privileges are not needed.

In FreePBX prior to 17.0.8, the OAuth2 implementation in the API module does not properly validate client credentials during token issuance. The validateClient() method in ClientRepository.php always returns true, allowing anyone with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret.

A vulnerability in DreamMaker by Interinfo allows unauthenticated local attackers to read arbitrary system files via Relative Path Traversal.

DreamMaker by Interinfo has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.

An unhandled exception in Suprema BioStar 2 (Server) versions 2.9.8, 2.9.10, and 2.9.11 allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending HTTP POST requests to the '/api/migration' endpoint. This triggers a failure that halts critical processes, leaving the system offline until manual restart of services or the server.

HAX CMS versions up to 26.0.0 contain a stored XSS vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with page editing permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.

A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.

An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.

A CWE-78 OS Command Injection vulnerability was identified in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040. Attackers with access to the TX Host can execute code on the RX Host when a MySQL connector is configured.