CVE Vulnerability Catalog

A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Performing a manipulation of the argument search_box results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session.

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSocket session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset.

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) a user would be authenticated even if the user did not exist in the DataSourceRealm.

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.

Improper Authorization vulnerability in Apache Tomcat caused by security-role-ref definitions being incorrectly used as role aliases within the Realm in addition to the correct usage with Request.isUserInRole().

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.

Improper input validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. Affects versions 11.0.20-11.0.24, 10.1.53-10.1.57, and 9.0.115-9.0.120.

Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorized local user to access the socket. Affects versions from 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.42 through 9.0.120.

Improper access control and incorrect authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. Affects a wide range of versions from 7.0.0 through 11.0.24.

Faktory prior to version 1.10.0 is vulnerable to an unauthenticated denial of service where a single malformed command crashes the entire process. The wire protocol is line-based, and several command handlers slice or index the received line without checking for a payload, causing a Go slice or index out-of-range panic. The attack requires only a connection to the command port and completion of the trivial handshake, with no credentials when no password is configured.

Typebot in self-hosted versions prior to 3.18.0 has a vulnerability in the Send Email integration block that allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from typebot variables, and its parseAttachments helper returns the supplied value as a filesystem path whenever it does not start with the application's own base URL. The Nodemailer transport is created without disabling file access, so an attachment specified as an absolute server path is read from the local filesystem and delivered.

Typebot up to version 3.17.1 (self-hosted) has a brute-force vulnerability in the default passwordless email magic-link authentication. The code is generated using Math.random() and has only 900,000 possible combinations, with no attempt limits or lockouts, allowing account takeover. An attacker knowing the victim's email address can gain full access without victim interaction.

TypeBot prior to 3.18.0 has a vulnerability that allows any authenticated non-guest workspace member to remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler authorizes a caller against a client-supplied workspaceId but sends the client-supplied domain name to the shared Vercel project before verifying that the domain belongs to that workspace.

Broken access control vulnerability in the IP lock manager in GazellePW (GazellePosterWall) allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock.

Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in /subtitles.php?action=delete.

Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf which is later rendered in the data-tooltip attribute in /forums.php?action=viewthread and interpreted as HTML by the Tooltipster configuration.