555 matches found
CVE-2025-10692: Improper Neutralization of Special Elements used in an SQL Command
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-57682: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution via the "POST /api/file/s3/get-presigned-get-url-proxy" API...
CVE-2025-47870
Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id...
CVE-2025-47870: Missing Authentication for Critical Function
Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id...
CVE-2024-42411
Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to restrict the input in POST /api/v4/users which allows a user to manipulate the creation date in POST /api/v4/users tricking the admin into believing their account is much older...
CVE-2024-12766
parisneo/lollms-webui version V13 feather suffers from a Server-Side Request Forgery SSRF vulnerability in the "POST /api/proxy" REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter...
CVE-2024-9309 SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava
A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 LLaVA-1.6. This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized...
CVE-2024-10835
In eosphoros-ai/db-gpt version v0.6.0, the web API "POST /api/v1/editor/sql/run" allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the...
CVE-2024-11042
In invoke-ai/invokeai version v5.0.2, the web API "POST /api/v1/images/delete" is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite...
CVE-2024-8999
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...
CVE-2024-10901: Unrestricted Upload of File with Dangerous Type
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file...
CVE-2024-11042: External Control of File Name or Path
In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite...
PT-2025-12144
Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V13 feather Description The issue is a Server-Side Request Forgery SSRF vulnerability in the "POST /api/proxy" REST API. Attackers can exploit this to access unauthorized web resources by specifying the JSON...
PT-2025-12258
Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version v1.4.25 Description The issue is an improper access control vulnerability in the "POST /api/v1/data-warehouse/bigquery" endpoint. This allows any user to export the entire database data by creating a stream to Google...
PT-2025-12094
Name of the Vulnerable Software and Affected Versions invoke-ai/invokeai version v5.0.2 Description The web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion, allowing unauthorized attackers to delete arbitrary files on the server. This can include critical or sensitive syst...
CVE-2024-12766: Server-Side Request Forgery (SSRF)
parisneo/lollms-webui version V13 feather suffers from a Server-Side Request Forgery SSRF vulnerability in the POST /api/proxy REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter...
CVE-2024-8999: Missing Authorization
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. Th...
CVE-2025-27142
LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the "POST /api/localsend/v2/prepare-upload" and...
CVE-2025-27142: Improper Limitation of a Pathname to a Restricted Directory
LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network without needing an internet connection. Prior to version 1.17.0, due to the missing sanitization of the path in the POST /api/localsend/v2/prepare-upload and th...