CVE Vulnerability Catalog

In Dokploy version 0.19.0 and earlier, the protectedProcedure middleware only verifies user authentication but does not enforce organization scoping. Each endpoint must individually verify that the resource belongs to the user's organization. This affects multiple endpoints in various files.

Macrozheng mall up to version 1.0.3 has an authorization bypass vulnerability in the Super Admin Password Handler component in the /admin/update/ file. The attack can be performed remotely.

Bolt CMS up to version 3.7.0 contains an SQL injection vulnerability in the 'order' parameter of content listing pages. An authenticated attacker with low privileges can exploit this via the OrderDirective component, allowing extraction of sensitive information.

SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in the user registration functionality in register.php.

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers can bypass private-network SSRF policies by reusing blocked tabs to export or inspect protected content.

OpenClaw before version 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands. Authenticated senders can skip DM-only and allowFrom policy checks, allowing them to route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked.

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

OpenClaw before version 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals. Users with limited exec permissions can bypass approval splits and approve plugin actions outside operator configuration.

In ACM/MCE assisted-service, when pull-secret validation fails, raw pull-secret contents are written into `InfraEnv.status.conditions[].message`. A user with the default `view` ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's `.dockerconfigjson` data from status.

In XX-Net version 5.16.6, a WebSocket frame parsing vulnerability exists in the WebSocket_receive_worker function. The server always reads 4 bytes as a masking key regardless of the MASK flag, leading to data corruption and missing validations.

A stack-based buffer overflow vulnerability was discovered in the TRENDnet TEW-432BRP router version 3.10B20 in the formSetPortTr function of /goform/formSetPortTr. The attack can be performed remotely by manipulating the special_name argument. The vendor states the product has been EOL for 15 years and will not be fixed.

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page with a hidden form that automatically submits POST requests to users.php with admin permissions.

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id parameter. Attackers can send GET requests to navigate_download.php with payloads like ../../../cfg/globals.php to access sensitive configuration and system files outside the intended directory.

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.

Wikidforum 2.20 has a cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts via the reply_text parameter in the rpc.php endpoint. Scripts execute in other users' browsers when viewing forum replies.

Mermaid, a JavaScript diagramming tool, has a CSS injection vulnerability in its default configuration prior to versions 10.9.6 and 11.15.0. The fontFamily, themeCSS, and altFontFamily options allow injecting CSS that escapes the #mermaid-xxx scoping, enabling page defacement and DOM attribute exfiltration via :has() selectors.

Mermaid before versions 10.9.6 and 11.15.0 is vulnerable to a denial-of-service attack when rendering Gantt charts if the excludes attribute is used to exclude all dates.

In the Indian Motorcycle Scout Bobber + Tech 2025 model, improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the WCM wiring harness to bypass the anti-theft shutdown. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit condition; interrupting the relevant wires leaves the motorcycle fully operable even without PIN validation.

In the Indian Motorcycle Scout Bobber + Tech (2025 model year), an expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. By injecting CAN error frames, the attacker causes the WCM to stop transmitting all messages, including the shutdown command. Other ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer.

In WWBN AVideo version 29.0 and earlier, the endpoint plugin/AuthorizeNet/processPayment.json.php credits the user's wallet based solely on the attacker-controlled amount parameter, without validating any Authorize.Net transaction. This allows any logged-in user to add arbitrary funds to their AVideo wallet.