CVE Vulnerability Catalog

A vulnerability in PV-Bhat gemsuite-mcp 1.0.0 affects some unknown functionality in src/handlers/unified-gemini.ts of the gemini_search/gemini_reason/gemini_process/gemini_analyze component. Manipulation of the argument file_path/file_paths results in path traversal. The attack must be initiated from a local position. The project was informed but has not responded.

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When manage_relationship is used with on_lookup: :relate on a belongs_to relationship, the client-supplied lookup value is passed to Ash.Query.filter/2 without being cast to the attribute type. A nested map submitted where a scalar is expected is therefore interpreted as a filter predicate rather than a literal, so a lookup for a specific record becomes a query for any record matching a condition. The same path omits Ash.Query.limit(1), leaving Ash.read_one/2 able to distinguish no match from one match from several, which turns comparison predicates into an oracle for the lookup value. Authorization is unaffected; the destination read policy still applies.

A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code in /sso/getAuthCode of the mall-portal module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue without explanation and did not respond to email contact.

A vulnerability was found in lossless-cut up to version 3.69.0, leading to server-side request forgery (SSRF) in an unknown functionality of the file src/main/httpServer.ts in the Built-in HTTP API Service component. The attack requires access to the local network and is characterized by high complexity. The exploit has been publicly disclosed.

The Nexter Blocks WordPress plugin before version 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.

The Slim SEO WordPress plugin before version 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.

A weakness has been identified in shadcn-vue-mcp up to version e170e277b94235cde627803277fc8c41103a4d38. The issue affects the fs.promises.readFile function in src/server/callback-server.ts, where manipulation of the filepath argument causes path traversal. The attack is restricted to local execution.

A vulnerability in the Zephyr kernel's z_queue_node_peek() in kernel/queue.c reads a node from the data_q list without holding the queue spinlock. A concurrent k_queue_get() can free the node during the operation, leading to use-after-free and a dangling pointer. This affects k_fifo and k_lifo queues used in net_buf, Bluetooth, USB, and networking subsystems.

A vulnerability in HKUDS nanobot up to 0.2.1 affects the ExecTool._prepare_command function in nanobot/agent/tools/shell.py of the Login-shell Environment Handler component. Executing a manipulation can lead to information disclosure. The attack requires local access, and the exploit has been published.

pypdf prior to 6.15.0 is vulnerable to excessive memory consumption when parsing crafted PDFs, as the parse_bfrange function in pypdf/_cmap.py handles unusually large tokens in a font /ToUnicode CMap during text extraction. This issue is fixed in version 6.15.0.

A vulnerability in the pypdf library prior to version 6.15.0 allows long runtimes and high memory consumption when extracting text from a crafted PDF. The Font._collect_cid_character_widths function expands unusually large CID font /W width ranges or excessive width entries. The issue is fixed in version 6.15.0.

Hono is a web application framework supporting any JavaScript runtime. From 4.7.0 to 4.12.33, the proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110, an intermediary must remove these headers before forwarding, but the function only removes standard hop-by-hop headers, potentially leading to disclosure of internal metadata.

Frappe is a full-stack web application framework. Prior to versions 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email.

A vulnerability in SourceCodester Photo Share Website 1.0 affects an unknown part of the file /social/ajax.php?action=save_upload of the Comment Input Box component. Manipulation of the content argument leads to cross site scripting. The attack may be initiated remotely, and the exploit is publicly available.

File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, the rotate method assumes that the file is absent and does not rotate it, but touches the file, which creates the target. An attacker who can create the symlink can use this to create an arbitrary file with permissions of the process rotating the files.

Nexus Repository 3 has a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user with nexus:settings:update permission could submit arbitrary host and port values to the email test endpoint, causing the server to attempt outbound connections to internal or restricted addresses. Response differences could be used to infer reachability of internal hosts and ports. Affects up to 3.94.1, fixed in 3.95.0.

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account with nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed, disclosing internal JVM class metadata such as class and classloader names. This does not allow method invocation, object construction, or arbitrary code execution. Fixed by restricting property access in the JEXL sandbox.

A cross-site scripting vulnerability was found in SourceCodester Photo Share Website 1.0 in an unknown function of the file /social/index.php?page=home. Manipulation of the Comment argument causes XSS. The attack can be initiated remotely and the exploit is public.

A vulnerability was detected in WonderTrader up to 0.9.9 in the function TraderDD::queryTrades of src/TraderDD/TraderDD.cpp. Manipulation of the FID_JYLB argument results in enforcement of behavioral workflow. The attack can be launched remotely but is difficult to exploit. The exploit is public and the vendor did not respond.

A cross-site scripting vulnerability was found in PHPGurukul Company Visitor Management System 1.0 in the file /manage-newvisitors.php. Manipulation of the fullname argument leads to XSS. The attack can be initiated remotely and the exploit is public.