CVE Vulnerability Catalog

ApiAdmin v5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.

GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes eval("\$array = $data;") whenever the decoded string starts with array. An attacker can inject arbitrary PHP code into the eval call and achieve RCE.

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

The LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

A vulnerability was found in TallCMS up to 4.8.0 affecting the PluginManager component in ThemeManager.php. Manipulation of input can lead to remote code injection. The exploit has been publicly disclosed and may be used.

In Plane prior to 1.4.0, the aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges.

The mppx-condition-gate and mppx-token-gate packages prior to versions 3.0.0 and 1.0.4 respectively read a wallet address from client-supplied credential.source, check whether that public address met configured on-chain conditions, and return a successful free-access receipt without invoking the payment verifier or proving caller control of the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the cache lifetime.

Kunstmaan CMS prior to 7.3.2 performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and then lowercases the stored extension. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types.

The Joomla extension TF Content versions 2.9.0–2.9.4 unconditionally authorizes creation and editing in its public RecordController. A guest can obtain a valid token from Joomla's public login form and modify any record, including mass-assigning published, access, and created_by fields.

In the Joomla Event Gallery extension versions below 6.6.0, there is XSS and open redirect on the share mini page. The article address from the shared link is printed without checking or escaping, and with the link type "Image Page with Redirect" it follows the address immediately.

In the Joomla Event Gallery extension versions below 6.6.0, eight tasks called by back-end list buttons do not check the form token. A prepared page on another site could trigger them in the name of a logged-in administrator and change settings and flags.

In the Joomla extension Phoca Cart versions 5.0.0 - 6.1.8, the order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user, including a guest with no account, can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.

The Joomla extension OrdaSoft CCK before version 8.3.16 contains an unauthenticated SQL injection vulnerability. The order column for records was user provided and not properly validated, leading to a SQL injection vector.

In the Dynamic Content Filter addon in SP Page Builder Pro versions 3.0.0–5.6.1p2, there is reflected XSS. The slider minimum and maximum values are taken from the dc_filter_<fieldId> parameter, split on "l-r", HTML-escaped inside the data-value attribute, and then echoed without escaping as the span element's text content.

In mcp-k6, a caller who can invoke the convert_playwright_script prompt can pass a bare file path as the playwright_script argument and read any file accessible to the server's user, including SSH keys and cloud credentials (path traversal). The working-directory restriction for '@'-prefixed paths can also be bypassed using a symbolic link pointing outside the working directory.

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.

Northstar (quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).