CVE Vulnerability Catalog

WebsiteBaker CMS before version 2.13.10 has a code injection vulnerability in the Droplets editor. An authenticated administrator can save arbitrary PHP code in the Code field, which is written to a publicly accessible file, enabling remote code execution by unauthenticated users.

The brace-expansion library prior to versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9 contains a vulnerability where the expand() function does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the event loop.

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client and use the password grant to obtain an API access token, bypassing normal web interface authentication and any enforced multi-factor authentication controls.

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

Apache Jena Fuseki through version 6.1.0 contains a path traversal vulnerability. An attacker can bypass path restrictions and access files outside the allowed directory.

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation.

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. The function strcpy in upload.cgi of the lighttpd component mishandles the HTTP_COOKIE argument, leading to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.

A weakness has been identified in Razer RzUpdateService 1.10.14.0. The vulnerability affects the Named Pipe Handler component in RzUpdateService.exe. Manipulating the lpThreadParameter argument leads to improper privilege management. The attack requires local access and the exploit has been made public.

A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. The vulnerability affects an unknown function in the AppCheckD.sys library of the Kernel Mini-Filter Driver component, leading to an uncontrolled search path. The attack requires local access, is complex to exploit, and the exploit has been released publicly. The vendor did not respond.

XML::Sig for Perl versions 0.29 through 0.71 allow signature verification bypass. The verify function returns true when every signature was skipped before any cryptographic check. An attacker can supply an XML document with two Signature elements whose URI references a non-existent ID, causing verify to return true without checking the signature.

Telenia Software TVox versions 26.5.3 and prior 26.x, and 24.9.21 and prior 24.x, contain a privilege escalation vulnerability. An insecure sudoers configuration in /etc/sudoers.d/telenia grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to execute arbitrary commands as root.

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys, achieving remote code execution when git performs ssh operations.

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots with the ucode docker_rpc.uc backend) contains an OS command injection vulnerability. The docker.container.ttyd_start method is exposed via ubus, and the run_ttyd handler builds a shell command from request-controlled fields (id, cmd, uid) and passes it to system() without quoting. An authenticated attacker with only read ACL can inject shell metacharacters and execute arbitrary commands as root.

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script. Unauthenticated attackers can supply directory traversal sequences in the query string to read files outside the configured runtimeDir.

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the configuration state, allowing unauthenticated attackers to read forum topics and posts.

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(). The function passes its unsanitized $image argument to UniformResourceLocator::findResource(), which only lexically collapses '..' segments without a realpath check. An editor with page-editing rights can use Markdown image syntax with traversal sequences to composite arbitrary image files outside the media sandbox into a carrier image, which is then served publicly.

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives. Blueprint::isSafeDynamicCall() only applies its denylist to strings without '::'. An account with page-editing rights (admin.pages) can plant a directive that invokes an arbitrary public static PHP method with attacker-controlled arguments. This allows reading any server-readable file and arbitrary creation/copying of files and directories.

SiYuan versions before v3.7.3 fail to validate the avID parameter in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.