CVE Vulnerability Catalog

A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.

A vulnerability was found in the File Tools component of mosaxiv clawlet up to version 0.2.10, involving symbolic link following in the read_file, write_file, and edit_file functions within tools/fs_ops.go. The attack requires local access.

A server-side request forgery (SSRF) vulnerability was found in the mosaxiv clawlet library up to version 0.2.10 in the tools.webFetch function of tools/tool_web_fetch.go. The attack can be launched remotely, and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability has been identified in the IPv4 Handler component of mosaxiv clawlet up to version 0.2.10. The issue is in the web_fetch function in tools/tool_web_fetch.go, where manipulation of the url argument allows an attacker to send requests to internal resources. The attack can be performed remotely and the exploit has been made public.

A security flaw in mosaxiv clawlet up to version 0.2.10 affects the exec Safety Guard component. The guardExecCommand function in tools/tool_exec.go fails to provide effective protection, allowing remote bypass of security mechanisms. An exploit has been publicly released, and the GitHub issue was closed with the label 'not planned'.

In HedgeDoc prior to version 1.11.0, the GitHub Gist export flow had an OAuth2 state validation flaw. The state parameter was only checked for presence, not validated against the user's session, allowing an attacker to forge a callback URL. A logged-in victim clicking a crafted link could export their private note to an attacker-controlled Gist.

A vulnerability was found in tanstack db up to version 0.6.8 in the select function of the Alias Path Handler component. Manipulation leads to improperly controlled modification of object prototype attributes, exploitable remotely. The exploit is public.

A symlink attack vulnerability in FlashAttention through version 2.8.3.post1 (fixed in commit 0816ef1) exists in the download_and_copy() function within hopper/setup.py, which extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.

OpenClaw versions 2026.5.28 through 2026.6.5 contain an authorization bypass vulnerability in native web search. This allows lower-trust callers to perform actions requiring stronger policy checks.

OpenClaw versions 2026.6.5 through 2026.6.8 contain a vulnerability in the plugin installation wrappers that can bypass the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization.

HedgeDoc versions prior to 1.11.0 allowed attackers to bypass rate-limiting on /login and /register routes by spoofing the cf-connecting-ip header. The application trusted this header even when the request did not originate from Cloudflare, enabling login spam or mass account creation.

HedgeDoc before version 1.11.0 was vulnerable to stored HTML Injection due to unsafe handling of the local-part of registered email addresses. An attacker could register a specially crafted email address and inject arbitrary HTML into pages viewed by other users.

The SCORM lab launch endpoint in Skillable (formerly Learn on Demand Systems) does not validate the client-supplied userId parameter against the authenticated SCORM session token. An authenticated user can substitute arbitrary userId values to bypass per-user lab launch rate limits and consume other users' lab allocations.

A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by abusing the 'Send Support Information' feature. The attack requires prior low-privileged code execution on the target system.

A vulnerability in AnyDesk allows a local attacker to cause a denial-of-service (DoS) condition by manipulating screen recording files. The attacker must first obtain the ability to execute low-privileged code on the target system.

A vulnerability has been identified in antv layout version 2.0.0, involving uncontrolled modification of object prototype attributes. The issue is in the setNestedValue function in lib/util/object.js, where manipulation of the path argument can lead to prototype pollution. The attack can be launched remotely.

A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /subject.php file. An unknown function allows manipulation of the subject argument, enabling script injection. The attack can be performed remotely and the exploit is publicly available.

A cross-site scripting vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /forsubject.php. An unknown function mishandles the subject argument, allowing injection of malicious scripts. The attack can be performed remotely and the exploit has been publicly disclosed.

In ChurchCRM prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse 'has any admin permission' gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Module Title' parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping.