CVE Vulnerability Catalog

A security vulnerability has been detected in YzmCMS up to version 7.5. The function get_url in the file /yzmphp/yzmphp.php of the Header Handler component is affected. Manipulation of the HTTP_HOST argument leads to cross-site scripting (XSS), which can be exploited remotely. The exploit has been publicly disclosed and may be used.

A weakness has been identified in json-schema-ref-parser up to version 15.3.5, affecting the Refs.set and Pointer.set functions in lib/pointer.ts. Manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely.

In Open WebUI from version 0.8.11 before 0.10.0, the POST /api/v1/images/edit endpoint only required a verified account but did not enforce the global image-edit switch or per-user image-generation permission. This allowed a non-admin user to invoke server-side image editing with administrator-configured provider credentials.

In Open WebUI from version 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can bypass access control to a restricted underlying model via task endpoints like /api/v1/tasks/moa/completions. The normal chat route checks the arena model before dispatching, while the task route calls generate_chat_completion() directly with bypass_filter=True, skipping the submodel's access check.

In Open WebUI prior to version 0.10.0, the WEB_FETCH_FILTER_LIST matching compared configured host entries against URL strings, allowing bypass of blocklists via path-based entries (e.g., !internal.example.com) and sibling-domain matches that did not reflect the intended hostname policy.

A vulnerability in Open WebUI versions 0.7.0 through 0.10.0 allows a regular channel participant to retrieve sensitive settings of other users, including API keys and webhook configurations, via a GET request to /api/v1/channels//members. The issue is fixed in version 0.10.0.

A vulnerability in Open WebUI before version 0.10.0 allowed a ReDoS (Regular Expression Denial of Service) attack by sending a specially crafted chat message containing <$ without a closing >. The SKILL_MENTION_RE and strip_re regular expressions in backend/open_webui/utils/middleware.py caused quadratic backtracking, blocking the asyncio event loop.

In Open WebUI prior to version 0.10.0, the /api/v1/auths/signin endpoint allowed account enumeration via timing side-channel. Requests for registered users were measurably slower (due to bcrypt verification) than for non-existent emails, enabling unauthenticated attackers to enumerate valid accounts.

In Open WebUI prior to version 0.10.0, the file upload path accepted the metadata.knowledge_id parameter and automatically linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files.

In Open WebUI before version 0.10.0, the _verify_knowledge_file_access function only checked read permissions, while file write and delete routes later trusted permissions derived from the writable model meta.knowledge object. This allowed a user with read-only knowledge file access to gain file write or delete capabilities.

In n8n prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node and exfiltrate the secret through item data.

The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup without output escaping, resulting in stored cross-site scripting. An authenticated user with TAG MANAGEMENT create or update rights can set a tag name containing HTML, which then executes in the browser of any user who opens the Kanban view of a ticket, problem, change, or project the tag is attached to.

An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera (version 1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service (DoS) via a crafted DESCRIBE request with a malformed URL.

A vulnerability was found in openclaw-android up to version 0.4.0, allowing OS command injection in the JsBridge.kt file. The flaw resides in the WebView bridge component and can be exploited locally. An exploit has been publicly disclosed, and a fix is pending acceptance.

A missing authentication vulnerability has been found in Mettle SendPortal up to version 3.0.1, affecting the APIv1 Webhooks component for sendgrid/postmark/postal/mailjet functions. The attack can be carried out remotely and the exploit has been publicly disclosed.

A vulnerability has been found in Mettle SendPortal up to version 3.0.1 in the campaign creation endpoint. Unknown code in CampaignStoreRequest.php allows remote authorization bypass. The exploit has been published and may be used.

An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.

In n8n prior to versions 2.27.4 and 2.28.1, when configured with more than one trusted token-exchange issuer, external identities were resolved to local accounts using only the JWT sub claim, ignoring the iss claim. This allowed an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim.

In n8n prior to versions 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL. This allowed a member-level user with use-only access to a shared credential to send its secret to an external server they control.

A security vulnerability was detected in the aerostackdev aerostack-mcp project up to version 6315dfde7df0a15aaf743f88d91347115e09ba23. The upload_media function in the mcp-whatsapp component allows manipulation of the media_url argument, leading to server-side request forgery (SSRF). The attack can be launched remotely.