CVE Vulnerability Catalog

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 affecting an unknown function in /deletetransac.php. Manipulating the ID argument results in SQL injection, and the attack can be performed remotely. The exploit has been made public and could be used.

A vulnerability was found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 affecting the BlitzBanks function of the Skynet++ Virtual Machine component. Manipulation can lead to an out-of-bounds write, and the attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in SteelRaven7 Ravenfield 25407073 affecting the cacheCoverPoints function of the RFL/RFLD Custom Map Handler component. Manipulation results in deserialization, and remote exploitation is possible. A patch named EA39 Security Patch is available.

A security vulnerability was detected in CloudClassroom-PHP-Project affecting an unknown part of addnewstudent.php. Manipulation of the fname argument leads to cross site scripting, and the attack may be launched remotely. The exploit has been publicly disclosed and may be used; the product uses a rolling release model with no version details.

In ggml-org llama.cpp, the function list_pockettts_state_slots in tools/mtmd/models/pockettts-gen.cpp (Pocket-TTS component) allows out-of-bounds write via manipulation of the mmproj argument. The attack requires local access, and the exploit is publicly available. Upgrading to version b11796 resolves the issue.

In smg-project smg versions 1.7.0–1.10.1, the function jpeg_turbo::decode_jpeg_rgb in crates/multimodal/src/jpeg_turbo.rs (llm-multimodal component) leads to uncontrolled memory allocation. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 1.11.0 addresses the issue.

Incorrect Authorization vulnerability in ash_postgres allows a user to read another tenant's record through a skipped upsert. When a create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped, the data layer reads the existing row by upsert identity without applying attribute multitenancy, potentially exposing another tenant's fields.

Incorrect Authorization vulnerability in ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many or through relationship is loaded with a lateral join, the query for the join resource is built without running its read action, which applies attribute multitenancy, causing rows from other tenants to be joined.

Incorrect Authorization vulnerability in ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship with through: is loaded for a single record with a limit of 1, or an unsorted has_one through relationship with a limit of 1, the read path chosen lacks a filter linking destination to source, returning the first destination record by sort or another record with an offset.

A weakness was identified in DedeCMS up to 5.7.118 in the require_once function of dede/update_guide.php. Manipulating the vtime argument causes code injection. Remote exploitation is possible and the exploit has been made public.

A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 in the JuelScriptEngine.eval function of JuelScriptEngine.java. Manipulation of input results in code injection, and the attack can be initiated remotely. The vendor was contacted early but did not respond.

A vulnerability has been found in KodCloud KodExplorer up to 4.55 in an unknown functionality of app/controller/editor.class.php within the Online Editor Save Endpoint component. Manipulation of the path/filestr argument leads to unrestricted upload, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond.

A flaw has been found in KodCloud KodExplorer up to 4.56 in the request_url_safe function of app/function/web.function.php within the Remote Download component. Manipulation causes server-side request forgery, and the attack can be initiated remotely. The vendor was contacted but did not respond.

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. An unknown function of the file /opils/admin/deleteproduct.php is vulnerable to SQL injection through manipulation of the ID argument. The attack can be performed remotely, and the exploit is publicly available.

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allow_raw_html gate, executing JavaScript for every page viewer.

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.

Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.