CVE Vulnerability Catalog

In Grafana, an authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload. A user with tag editor permission could craft a request that includes additional model data (such as User or Organisation records), enabling modification or creation of privileged accounts and escalation to site administrator.

In OS4ED openSIS-Classic up to version 9.3, the save action function in modules/students/Student.php (General Information Tab component) is vulnerable to SQL injection via manipulation of the students argument. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.

Authentication bypass via LDAP injection in the sshd-ldap component of Apache MINA SSHD. Lack of escaping LDAP filter metacharacters enables successful authentication with username "*" and password "*".

A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD allows bypassing authentication checks. The vulnerability only affects servers using LdapPasswordAuthenticator for password authentication.

In Apache MINA SSHD versions 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-sftp component in the SFTP v6 check-file-name/check-file-handle extension is vulnerable to server-side memory exhaustion. Using a very small block size (e.g., 256) on a huge file generates many hashes, and the SFTP reply is accumulated in memory, potentially crashing the server.

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD. The SFTP client implementation did not check that a received reply corresponded to a previously sent request, causing unsolicited replies to be stored but never consumed. A malicious server could send such replies until client memory is exhausted.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the ssd-scp component is vulnerable to uncontrolled resource consumption. The SCP protocol is line-oriented, and the handler did not impose a limit on line length. A malicious peer sending an endless sequence of characters without LF can cause memory allocation and application crash due to OutOfMemoryError.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-git component has improper input validation. The fix for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. Authenticated SSH clients can remotely execute git commands, including writing archives on the server.

Apache MINA SSHD allows partial authentication bypass. When the SSH server is configured to require two different public keys, the server code in component sshd-core does not enforce that the presented keys are different. A user can successfully authenticate by presenting the same key twice.

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this to cause incorrect data processing or a denial-of-service condition.

Authentication bypass in sshd-core of Apache MINA SSHD. A flaw in the implementation of the "asynchronous authentication" mechanism could potentially lead to skipping signature checks in public-key or hostbased authentication, or returning a wrong result.

Information disclosure in BVMS 4.5 up to 12.3 allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints, the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller's context. However, the underlying ORM's set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields. An authenticated user with basic write permissions can exploit this to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id. An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance, leading to unauthorized read access to events of other organizations, and if the delegation is accepted, transfer of event ownership.

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures, which can be trivially bypassed.

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to and including 7.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is further enabled by the absence of capability, nonce, or ownership checks on the wp_ajax_rem_create_pro_ajax handler, and because the value is persisted via update_post_meta, the wp_kses filtering does not apply.

The ReactPress – Create React App for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to and including 3.4.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body is written verbatim to disk via file_put_contents().

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.

In Moodle, the XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. An attacker can trick an authenticated user with grade management permissions into visiting a malicious webpage, triggering unauthorized requests on the victim's behalf. This allows a remote attacker to set or overwrite student grades without authorization.