CVE Vulnerability Catalog

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files.

Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.ts connect to an internal address after a public address passed validation, with full response access and arbitrary REST methods. The fix adds createPinnedLookup support to the undici dispatcher and passes the validated address to custom fetch implementations. This issue is fixed in version 3.40.0.

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves the request to the protected file, enabling unauthorized file download without credentials.

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions (DSOP) values to ServerProxy::setOptions() in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m_modifierTranslationTable, after which ServerProxy::translateKey() or ServerProxy::translateModifierMask() indexes the seven-row s_translationTable or s_masks arrays out of bounds, disclosing four bytes at an attacker-selected relative offset or crashing the connected client; an odd option count also causes an out-of-bounds OptionsList read. This issue is fixed in continuous build 1.26.0.299.

ERPNext prior to versions 15.116.0 and 16.23.0 contains a vulnerability where an unvalidated doctype filter is interpolated into raw SQL in get_sales_details and get_last_sales_amt, allowing an authenticated user to extract sensitive information and manipulate database queries.

WordPress is vulnerable to remote code execution via malicious Postscript file upload by an Author level user or higher, when Imagick and Ghostscript are in use on the server.

Budibase prior to version 3.39.19 has a vulnerability in the PostgreSQL datasource connector where the user-controlled schema field is interpolated into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator to execute arbitrary SQL.

Deskflow from version 1.17.0 until continuous build 1.26.0.296 has a vulnerability where a malicious Deskflow server can send an odd-length DSOP vector, causing an out-of-bounds read and crashing the connected client.

Budibase prior to version 3.41.3 has a vulnerability in the POST /api/attachments/:datasourceId/url endpoint, where an authenticated published-app user with the BASIC role can supply attacker-controlled bucket and key values and obtain signedUrl and publicUrl values backed by stored S3 datasource credentials.

vm2 prior to version 3.11.6 has a vulnerability where the bufferAllocLimit enforcement does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process.

Budibase prior to version 3.41.3 has a vulnerability in automation steps (outgoingWebhook, zapier, n8n, slack, discord) where they use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement, allowing an authenticated user to make server-side requests to cloud metadata and internal services.

FreeCAD prior to version 1.1.2 has a vulnerability in PropertyPythonObject::Restore() where the attacker-controlled module attribute from serialized PropertyPythonObject XML is passed directly to PyImport_ImportModule() while restoring a crafted FCStd document, executing module-level Python code. The legacy pickle branch also imports an attacker-controlled module and invokes its class constructor.

FreeCAD from version 0.19 until 1.1.1 has a vulnerability in the BIM Workbench where an eval() call is made on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes.

FreeCAD from version 0.19 until 1.1.1 has a vulnerability in the BIM Project Manager Load Template flow where attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis are passed directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template.

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability is fixed in Packer 1.16.0.

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.