CVE Vulnerability Catalog

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace on the instance, leaking issue metadata through activity events. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a project in another workspace when the victim project UUID is known. This violates tenant isolation and permits unauthorized cross-workspace changes to project metadata and configuration. This issue is fixed in 1.4.0.

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs to each project. Any authenticated workspace member, including a Guest with access to only one project, can enumerate names, descriptions, sprint dates, issue counts, progress snapshots, external integration IDs, linked URLs, and member lists for cycles and modules in private projects. The sibling WorkspaceLabelsEndpoint and WorkspaceStatesEndpoint apply the correct filter, making the cycle and module endpoints inconsistent outliers. This issue is fixed in 1.4.0.

Prior to version 1.4.0 of the Plane tool, the GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ endpoint exposes the full project member roster, including email addresses, names, avatars, and roles. The ProjectMemberPermission access control only checks whether the caller is an active member of any project in the workspace, but does not bind the check to the specific project_id. As a result, any authenticated user belonging to one project, including a Guest, can read the roster of another private project in the same workspace.

Prior to version 1.4.0 of the Plane tool, the WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access.

Prior to version 1.4.0 of the Plane tool, the GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint allows downloading project-bound files without enforcing access to the owning project. An authenticated user from the same workspace, not a member of the secret project, knowing the asset UUID, can receive a 302 redirect to a signed download URL. Affected types include ISSUE_ATTACHMENT, COMMENT_DESCRIPTION, PAGE_DESCRIPTION, and PROJECT_COVER.

Prior to version 1.4.0 of the Plane tool, the unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters without an allowlist and passes them to grouped paginators, where they are used as ORM field names. An attacker can supply arbitrary field paths that trigger unhandled FieldError or KeyError and HTTP 500 responses, or use them as a blind traversal oracle. The earlier fix for order_by did not cover these parameters.

Prior to version 1.4.0 of the Plane tool, a Project Member with role 15 can send a PATCH request to the project-member update endpoint and change another user's project role. The role-update logic blocks only a new role higher than the requester's role, so assigning the equal Member role bypasses the validation and promotes a Project Guest with role 5 to Member without Project Admin approval.

Prior to version 1.4.0 of the Plane tool, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace.

Prior to version 1.4.0 of the Plane tool, the GET /api/users/api-tokens/ endpoint allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows modifying the allowed_rate_limit field without server-side validation. A user can raise the limit arbitrarily and bypass API rate-limiting controls, enabling high-volume automated requests and potential resource exhaustion.

The Joomla extension TF Content versions 2.9.0 - 2.9.4 exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

The Joomla extension Event Gallery versions < 6.6.0 contains a server-side request forgery vulnerability in the Google Photos picker on the back-end upload page. The picker fetches thumbnails of picked images through the server, using the OAuth access token of the Google Photos account. The task takes the address from the request without checking it and asks for no form token. A prepared page on another web site could make the server send the access token to any address, or fetch addresses inside the server's network, in the name of a logged in administrator.

adm-zip prior to 0.6.1 applies Unix permission bits from a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and never filters out setuid/setgid/sticky bits. A crafted zip can produce an extracted binary with mode 04755, leading to attacker code execution as root when extraction runs as root.

ApiAdmin v5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.

GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

The LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

A vulnerability was found in TallCMS up to 4.8.0 affecting the PluginManager component in ThemeManager.php. Manipulation of input can lead to remote code injection. The exploit has been publicly disclosed and may be used.