CVE Vulnerability Catalog

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 2.9.3 is recommended to address this issue. Patch name: c143e145caa600947e70a240e87f2fed889149d3. It is suggested to upgrade the affected component.

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processes outside its sandbox, such as the desktop shell.

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input. `parse()` emits a comment token for a `#` in the middle of a word, so callers that combine `parse()` output with another untrusted string are affected. Fixed in 1.11.0: `quote()` throws a `TypeError` when a string after a `{ comment }` token contains a line terminator.

The pbkdf2 library through version 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback. Long passwords can block the event loop because the cost is proportional to iterations times password length. Affected are Node.js before 0.12, Bun (1.0.0-1.1.34 and 1.2.6+), Deno 2.9.0+, and direct imports of lib/sync.js.

A security flaw has been discovered in REBUILD up to 4.4.11 in unknown code of the /commons/file-editor-save file. Manipulation of the url/fileKey argument results in missing authorization. The attack can be launched remotely and the exploit has been released.

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5 in an unknown part of the /user/login file of the Login Endpoint component. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602 in the file application/database.php of the Database Management component. Manipulation leads to execution with unnecessary privileges. The attack can be launched remotely, and the exploit is public.

A weakness has been identified in MODSetter SurfSense up to 2.0.3 in an unknown function of the surfsense_backend/app/routes/circleback_webhook_route.py file of the circleback Endpoint component. Executing a manipulation can lead to missing authentication. The attack can be launched remotely and the exploit has been made public.

In LimeSurvey Community Edition 7.3.0, an authenticated user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the attacker's permission against the survey ID in the request URL, but the vulnerable persistence operations resolve the target object independently by its global qid or aid and never verify that it belongs to that authorized survey.

A security flaw was discovered in MODSetter SurfSense up to 0.0.36 in the file surfsense_backend/app/routes/editor_routes.py of the Document Export Feature. Manipulation results in server-side request forgery. The attack can be initiated remotely, and the exploit is public. Upgrading to version 0.0.36.3 is recommended.

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the file /lib/functions/backup_common.sh of the Backup/Restore component. Manipulation of the aes_pass argument causes use of a hard-coded cryptographic key. The attack can be initiated remotely, and the exploit is publicly disclosed.

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the eval function of the /www/cgi-bin/network_tools file of the Network Tools CGI component. Manipulation of the sid argument results in OS command injection. The attack can be performed remotely and the exploit has been made public.

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.