CVE Vulnerability Catalog

A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store contains recoverable eMudhra intermediate CA certificates. The issue impacts mongosh versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0, which bundles Node.js 24.22.1 or later.

Apache SIS from version 0.7 through 1.6 opens files referenced by processed data regardless of their paths, potentially allowing a local file path to be specified. This affects GML with xlink:href attributes, WKT with datum shift grid parameter elements, and Landsat scenes with GeoTIFF band file paths. Reading stops at the first parsing error, making sensitive information leakage unlikely.

In the SQL storage module of Apache SIS, when sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafted sort clause could inject SQL into the query. This affects the sql-storage module from version 1.0 through 1.6; other modules such as sis-referencing are not impacted.

Mattermost versions <=11.9, 11.1.9, 11.5.8, 11.10.7.0 fail to validate Zoom chat line length before slicing, which allows an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription containing short continuation lines.

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls.

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName() in ObjenesisBase.getInstantiatorOf(), same-named classes collide, causing newInstance() to return wrong-class objects and ClassCastException failures.

A weakness has been identified in Kameleo up to 5.0.1.26 affecting an unknown part of the /profiles file of the Local API component. The manipulation causes information disclosure and the attack can be carried out remotely.

A security flaw has been discovered in Kameleo up to 5.3.1 in the CookieController.ListCookies function of client-engine-application/w.cs of the Cookie Controller component. Manipulation of the guid argument results in information disclosure and the attack can be executed remotely.

A vulnerability was determined in Kameleo up to 5.0.1.26 in the InternalController.TestProxy function of client-engine-application/f.cs of the Proxy Validation component. Manipulation of the host/port argument can lead to server-side request forgery and the attack may be launched remotely.

A vulnerability was found in AllenAI AllenNLP up to 2.10.1 in the Registrable.resolve_class_name function of allennlp/common/registrable.py of the Registrable Configuration Machinery component. Manipulation of the Type argument results in code injection and the attack may be initiated remotely; the exploit has been made public.

A vulnerability has been found in JIZHICMS up to 2.5.6 in the Pay function of app/home/c/OrderController.php of the Front-end Order Handler component. Manipulation of the orderno argument leads to improper authorization and the attack can be launched remotely; the exploit has been disclosed publicly.

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or /etc/passwd and read them through the public theme path.

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that submits forged POST requests to photo/delete, album/save, photo/manageAccessSave or photo/saveField, deleting photos and changing access rights.

Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::ffff:127.0.0.1]) or 127.0.0.1. is not an IP address to a caller's allowlist built on uri_string:parse/1 and inet:parse_address/1, while hackney connects to the address it denotes. The same applies to a Location target when redirects are followed.