Kuafuai Aipexbase has a SQL injection vulnerability

The Kuafuai Aipexbase 690adb9 and previous versions have a SQL injection vulnerability. This vulnerability stems from the orderby and groupby fields in the/api/data/invoke endpoint. Attackers can exploit this vulnerability to bypass the SqlGuard blacklist and row-level security by using subquerie...

WordPress WSP MCP Authorization Issue Vulnerability

WordPress WSP MCP 2.9.5 and earlier versions have an authorization issue. This issue arises from the fact that the permissions requirement is set to empty when the wspgetposts MCP tool is registered. The authenticate method of the MCP endpoint allows arbitrary logged-in users to access it...

Wayn111 Waynboot-Mall Authorization Issue Vulnerability

The wayn111 waynboot-mall 2.0.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authentication. Unauthorized attackers can forge orders by calling the internal/callback/order/submit message queue callback, and provide arbitrary userId,...

FreeRDP has a numerical error vulnerability

FreeRDP versions 3.29.0 to 3.32.0 have a numerical error vulnerability. This vulnerability stems from integer overflows occurring during the Apple Audin backend’s calculations for audio queue buffer sizes. Malicious RDP servers can send specially crafted FramesPerPacket requests, resulting in...

mlogclub bbs-go authorization issue vulnerability

The mlogclub bbs-go versions 4.4.6 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of verification of the aud claim in the /api/login/googleonetap endpoint, allowing authentication bypass. Attackers can replay victim’s tokens to log in with the victim...

Mr. Wei ZKEACMS encryption issue vulnerabilities

Version 4.4 and earlier of Mr. Wei’s software have encryption-related vulnerabilities. These vulnerabilities stem from the use of a hardcoded HMAC-SHA256 signature key, which allows unverified attackers to forge REST API JWT holder tokens. They can set the Name declaration to “admin”, call the...

Getrebuild Rebuild authorization issue vulnerability

Getrebuild Rebuild 4.5.0 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization checks in the TaskCommentController.commentList component. It allows authenticated, low-privilege users to read task comments without having project membership. Attacke...

Nezhahq Nezha resource management error vulnerability

Versions of Nezhahq Nezha from 2.0.13 to 2.3.15 have a resource management vulnerability. This vulnerability stems from the lack of restrictions on concurrent connections at the/api/v1/ws/transfer WebSocket endpoint. Authorized attackers can create numerous ServerTransferClass.Subscribe...

Iku-soft Rdiffweb authorization issue vulnerability

The iKus-Soft RDiffWeb versions prior to 2.10.6 have a vulnerability related to authorization. This vulnerability stems from improper permission management in the user management API endpoint /api/users/usernameorid. Users who have been authenticated can elevate their permissions to administrator...

AllData authorization issue vulnerability

AllData 0.7.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from unvalidated JDBC injection attacks. Remote attackers can exploit this vulnerability by providing values for jdbcUrl and jdbcDriverClass at the data-dts/jobJdbcDatasource/test endpoint,...

Blair Jersyer NexoPOS authorization issue vulnerability

Blair Jersyer NexoPOS versions 6.2.4 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authentication in the/api/fields/resource/identifier API. Unverified attackers can access transaction field classes such as nsentity-transaction, and use sequentia...

Mattermost authorization issue vulnerabilities

Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have an authorization issue vulnerability. This vulnerability stems from the fact that the endpoint for switching account...

Smartloli EFAK authorization issue vulnerability

SmartLoli EFAK versions 5.1.0 and earlier have an authorization issue. This vulnerability stems from the lack of a role check for the/api/users endpoint. Certified low-privilege users can manage their accounts by sending POST, PUT, or DELETE requests to the UserController. This allows them to gra...

BeikeShop authorization issue vulnerability

BeikeShop versions 2.0.0.31 and earlier have an authorization issue vulnerability. This vulnerability stems from an insecure direct object reference in the markAsShipped handler of the RmaController. An attacker can submit consecutive RMA IDs to the account/rmas/id/markasshipped endpoint, overwri...

Finsys Dockhand authorization issue vulnerability

Finsys Dockhand versions prior to 1.0.34 have an authorization vulnerability. This vulnerability stems from the lack of mandatory authentication during WebSocket upgrade requests at the browser container endpoint/api/containers//exec. This allows unverified attackers to initiate raw WebSocket...

Mattermost input validation vulnerability

Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have a input validation vulnerability. This vulnerability stems from the failure to verify the integrity of the SAML...

tduck-survey-form authorization issue vulnerability

The tduck-survey-form 5.3 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification, which may allow any authenticated user to retrieve the original form settings of other owners through the GET /user/form/setting/key...

JoeyZhou Xiaozhi ESP32 Server Java Authorization Vulnerability

JoeyZhou Xiaozhi ESP32 Server Java 6.1.0 and earlier versions have an authorization issue. This vulnerability stems from an authentication bypass. Unverified attackers can obtain a valid device WebSocket token by making a request to/api/device/ota with any MAC address. This allows them to open th...

izhaorui Zr.Admin.NET SQL Injection Vulnerability

Zr.Admin.NET versions 3.8.2 and earlier have a SQL injection vulnerability. This vulnerability stems from the use of the GET /system/user/list endpoint to pass a specially crafted PagerInfo.Sort query parameter to the shared ToPage pagination helper function. Attackers can exploit this...

sgl-project SGLang Code Injection Vulnerability

The SGLang project from version 0.5.10 to 0.5.22 has a code injection vulnerability. This vulnerability stems from a code injection issue in the evaluatefilter function. Attackers can escape the eval sandbox by using re.search.globals, and can execute Python code. They can also send specially...