Checkmk Input Validation Vulnerability

Versions of Checkmk prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and 2.2.0 contain a vulnerability related to input validation errors. This vulnerability stems from improper validation of the reseturl parameter during the Setup page. It may allow attackers to trick users into opening a specially crafte...

Cassio Santos Whaticket Open Source Authorization Issue Vulnerability

Cassio Santos: Whaticket Open Source versions from cf04795 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references IDOR. ShowTicketService does not perform ownership or queue checks. Attackers can use the ticket IDs of other agents to...

Cassio Santos Whaticket Open Source: Permissions, licensing, and access control issues

Cassio Santos Whaticket Open Source versions from cf04795 onwards have vulnerabilities related to permission and access control. These vulnerabilities stem from authentication bypasses. Unauthenticated attackers can register as administrators by omitting the profile field or setting it to ‘admin’...

Lenovo Smart Camera C33 encryption issue vulnerability

Versions of the Lenovo Smart Camera C33 prior to 05.02.31.140 have a security vulnerability related to improper certificate verification. This vulnerability may cause adjacent users to intercept or manipulate network communications...

WHEELS.DEV: Wheel

WHEELS.DEV: In versions 4.0.0 to 4.1.2, there is a vulnerability related to input validation errors. This vulnerability stems from the use of case-insensitive comparisons on a case-sensitive file system. As a result, the checks for standard paths of zip entries, package maps, development...

Helicalinsight SQL injection vulnerability

Helicalinsight versions 7.0.0 and earlier have a SQL injection vulnerability. This vulnerability arises from report parameter values sent to /executeDatasource that are not properly escaped. Attackers can use custom Numeric or String placeholder values to bypass the ineffective SqlDetect...

Frappe HR Authorization Issue Vulnerability

Versions of Frappe HR prior to 15.58.3 and from 16.0.0 to 16.4.3 have an authorization issue. This issue arises because the HRMS PWA API endpoints do not perform consistent authorization checks for PWA API requests specific to individual employees. As a result, authenticated users may access...

IBM i race condition bug

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities due to race condition issues. These vulnerabilities stem from the Digital Certificate Manager DCM for System TLS, which causes a denial-of-service issue when applications attempt to establish secure network connections. This can result...

DeepSeek Harness: Permissions and access control issues

The DeepSeek Harness c291e796 version has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from an untrusted search path, which may allow attackers to execute arbitrary code by providing and executing a specially crafted executable file instead of...

IBM i Authorization Issues Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have authorization-related vulnerabilities. These vulnerabilities stem from improper execution of the boot version flag, which may allow local attackers to bypass NFS version restrictions...

Jacky Huang – Tencent Cloud Authorization Issue Vulnerability

The Tencent Cloud courses for versions 2.0.1 and earlier have an authorization issue vulnerability. This vulnerability stems from improper restrictions on authentication attempts. No expiration time or attempt limit is set for the 6-digit SMS/email verification codes. This allows unauthorized...

APIPark Authorization Issue Vulnerability

APIPark 1.9.7-beta and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Certified team administrators can access other teams’ services and applications by providing their own team ID in the team query parameter. This may...

Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

Mattermost information leakage vulnerability

Mattermost versions 11.9.1 and earlier of 11.9.x series, 11.8.5 and earlier of 11.8.x series, 11.7.10 and earlier of 11.7.x series, and 11.10.1 and earlier of 11.10.x series have a vulnerability related to information leakage. This vulnerability arises from the fact that the activity channel fiel...

Kuafuai Aipexbase has a SQL injection vulnerability

The Kuafuai Aipexbase 690adb9 and previous versions have a SQL injection vulnerability. This vulnerability stems from the orderby and groupby fields in the/api/data/invoke endpoint. Attackers can exploit this vulnerability to bypass the SqlGuard blacklist and row-level security by using subquerie...

Mailu Permission Authorization and Access Control Vulnerabilities

Mailu has a security vulnerability. This vulnerability stems from improper authorization. Domain administrators can reset passwords or obtain tokens for administrator accounts or domain administrators with higher privileges. This could lead to the takeover of highly privileged accounts and the...

BuildAdmin authorization issue vulnerability

BuildAdmin versions 2.3.9 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references. Verified backend administrators can modify other administrators’ profiles using the id parameter. Attackers with the routine/adminInfo/edit permission...

Wayn111 Waynboot-Mall Authorization Issue Vulnerability

Wayn111 and Waynboot-Mall versions 2.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authentication at the /callback/order/unpaid endpoint. Unverified attackers can cancel pending orders for any member by submitting a predictable orderSn value...

WordPress WP Event Solution Authorization Issue Vulnerability

WordPress WP Event Solution versions 4.1.26 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization settings, which may allow attackers to exploit incorrect access control levels...

IBM i Permission Licensing and Access Control Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper permission management, which may allow authenticated attackers to escalate their privileges and execute operations with QSECOFR/Root...

Wimoor Wanmo ERP: Wimoor authorization issue and vulnerabilities

Wimoor Wansuo ERP has an authorization issue. This vulnerability stems from the lack of validation for the X-USERINFO header. Attackers can directly access the backend service ports, bypass the gateway, and forge the companyid as well as the manager or admin usertype values. This allows them to...

i2nets abp-next-admin Authorization Issue Vulnerability

In the i2nets abp-next-admin version from 10.2.0 to 10.6.0, there is an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the LINGYUN.Abp.AIManagement module. Certified users can access other users’ AI chat conversations by providing their...

FreeRTOS-FreeRTOS-Kernel Authorization Issues Vulnerability

FreeRTOS’ FreeRTOS-Kernel versions 11.3.0 and 11.3.1 have an authorization-related vulnerability. This vulnerability stems from improper authorization for the Arm Cortex-R8 MPU port. It may allow non-privileged tasks to read from and write to privileged kernel memory outside the allocated area,...

Arcane Authorization Issues Vulnerability

Versions of Arcane prior to 2.11.0 have an authorization issue vulnerability. This vulnerability stems from the AuthMiddleware.managerAuth accepting the X-Arcane-Agent-Token credential, and the environment token branch calls next before evaluating the AdminRequired option. As a result, attackers...

Netcore NR256CN buffer error vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have a buffer error vulnerability. This vulnerability stems from the Boa web server’s userok function, which does not validate the length of the Basic-auth username. The username is copied into a 64-byte stack buffer using strcpy, allowing...

NDuckMink Arkon authorization issue vulnerability

The nduckmink arkon version 0.9.2 and earlier have an authorization issue vulnerability. This vulnerability stems from the by-id routing bypassing the canaccessdocument access control check in the app/routers/sources.py file. As a result, authenticated employees can call the plan, progress, PATCH...

10up Distributor deserialization injection vulnerability

The 10up Distributor versions prior to 2.3.2 have a deserialization injection vulnerability. This vulnerability stems from the setmeta function in includes/utils.php, which performs double deserialization of distributed article metadata. This may allow users at the Contributor level to instantiat...

WebVella ERP SQL Injection Vulnerability

WebVella ERP versions 1.8.8 and earlier have a SQL injection vulnerability. This vulnerability stems from the fact that the literal expressions in the WHERE clause of the EQL query API are not cleaned properly. Attackers can exploit this vulnerability by sending specially crafted single-quote...

Tandoor Recipes: Permissions, licensing, and access control issues

Versions of Tandoor Recipes prior to 2.6.12 have security vulnerabilities. This vulnerability arises from the fact that the StepViewSet and IngredientViewSet only filter by activity space, and they use role-level CustomIsUser checks instead of private recipe owners or shared predicates. When...

libp2p rust-libp2p resource management error vulnerability

The libp2p Rust-libp2p versions prior to 0.49.5 have a resource management vulnerability. This vulnerability arises from Gossipsub’s GRAFT control message processing, which does not verify whether the peer has previously subscribed to related topics before unconditionally adding the topic hash...

Kuaifan Dootask Authorization Issue Vulnerability

Kuaifan DooTask versions 1.9.66 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification in WebSocketDialog::checkDialog. It skips the membership checks for dialog boxes with grouptype set to 'okr'. Certified users can exploit this...

Arcadia Technology Crafty Controller Cross-site Scripting Vulnerability

The Arcadia Technology Crafty Controller versions from 4.2.0 to 4.11.0 have a cross-site scripting vulnerability. This vulnerability stems from improper handling of the Webhook URL form field component inputs. It may allow remotely authenticated attackers to execute stored-xss attacks through...

MZ Automation GmbH libiec61850 Resource Management Error Vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 contain a resource management vulnerability. This vulnerability arises from ReportingRCBWriteAccessHandler accepting an RptID exceeding 129 bytes when writing to the report control block. During report serialization,...

ubports lomiri-download-manager: Permissions, licensing, and access control issues

The ubports lomiri-download-manager version 0.1.0 to 0.3.3 had vulnerabilities related to permission licensing and access control. These vulnerabilities were caused by incorrect DBus policies, which could allow any user to execute arbitrary commands with root privileges via DBus...

Beizhu-1209 AIHelms Authorization Issue Vulnerability

The Beizhu-1209 AIHelms versions 0.1.25 and earlier have an authorization issue. This vulnerability stems from a lack of authorization verification in the apps/api/v1/efficiency.py file. It allows authenticated, low-privilege users to bypass the efficiency:read and efficiency:write permission...

GPAC mp4box security vulnerability

The GPAC mp4box 2.4 version has a security vulnerability. This vulnerability stems from a heap buffer overflow in the stblAddSize function isomedia/stblwrite.c, which could allow attackers to cause a denial-of-service attack by providing specially crafted MP4 files...

GStreamer gst-plugins-good buffer error vulnerability

GStreamer’s gst-plugins-good version prior to 1.28.2 has a buffer error vulnerability. This vulnerability stems from the qtdemuxparsechnl function in the isomp4 plugin during MP4 file parsing, which may cause out-of-bounds read access to global arrays, potentially leading to information leakage...

Netcore NR256CN Authorization Issue Vulnerability

Netcore NR256CN versions 1.5.140116 and earlier have an authorization issue vulnerability. This vulnerability stems from adding a public routing prefix to URIs, which can bypass authentication. Unauthenticated attackers can access protected management CGI handlers through routes with the .ico...

Themefic Tourfic Cross-site Script Vulnerability

Themefic Tourfic 3.0.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, which may lead to storage-based cross-site scripting attacks. Authentication attackers with privileges of subscribers and above can...

FasterXML Jackson-core resource management vulnerability

FasterXML Jackson-core versions prior to 2.16.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, and 3.2.0 through 3.2.2 contain a resource management vulnerability. This vulnerability arises from the character input parser failing to apply the maxNameLength lim...

Tandoor Recipes: Authorization issue vulnerability

Versions of Tandoor Recipes prior to 2.6.10 have an authorization issue vulnerability. This vulnerability arises from processing the/api/recipe-from-source/request. When searching by sequential primary key, there is no restriction on the createdby field. Attackers who are members of shared spaces...

Databufflabs Databuff Trust Management Vulnerabilities

Databufflabs Databuff versions 0.1.10 and earlier have a trust management issue. This vulnerability stems from the presence of hardcoded default credentials, allowing unauthenticated attackers to use the built-in admin/Databuff@123 account to obtain administrator privileges. They can then access...

Bytedeco JavaCV numerical error vulnerability

Bytedeco JavaCV versions prior to 1.5.14 have a numerical error vulnerability. This vulnerability stems from IPCameraFrameGrabber not checking for overflow or limiting the Content-Length when doubling the 32-bit buffer capacity. Malicious camera endpoints or tampered plaintext streams can return ...

Data-Infra Cube-Studio authorization issue vulnerability

The data-infra cube-studio versions from 2026.09.01 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references. Certified users can use IDs to stop, reset, clear, or redeploy other users’ Notebooks and services. An attacker can send...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.191 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postcontent' parameter, allowing storage-type cross-site scripting attacks. Authentication attackers with...

Frappe ERPNext Authorization Issues Vulnerability

Frappe ERPNext versions prior to 15.121.0 and 16.34.0 have an authorization issue vulnerability. This vulnerability stems from certain endpoints that modify states not performing appropriate authorization checks. Users with low privileges can call methods that alter states without writing,...

Countly path traversal vulnerability

Versions of Countly before 24.05.50 and from version 25.03 to version 25.03.44 contained a path traversal vulnerability. This vulnerability stemmed from the deletion of data migration routes in plugins/datamigration/api/api.js that were authenticated users. These routes did not validate the...

Smartloli EFAK authorization issue vulnerability

In versions 5.0.0 to 5.1.0 of smartloli EFAK, there is an authorization issue. This vulnerability stems from a lack of authorization checks. Certified low-privilege users can access the LLM provider’s API keys through the/api/model-config REST API, which may lead to unauthorized access and...

Abstract Machines Magistrala Authorization Issue Vulnerability

Abstract Machines Magistrala 1.0.0 and earlier versions have an authorization issue vulnerability. This vulnerability arises because members of the authentication workspace can view, issue, and revoke device certificates for other tenants by providing external serial numbers or entity IDs. This...

WordPress FluentCart: A New Era of eCommerce SQL Injection Vulnerabilities

WordPress FluentCart – A New Era of eCommerce. Versions 1.7.0 and earlier have a SQL injection vulnerability. This vulnerability stems from insufficient escaping of the parameter ‘products.variants.’ and inadequate SQL query preparation. This could allow authenticated attackers to append addition...