Adobe Commerce code injection vulnerability

Adobe Commerce has a code injection vulnerability, which stems from improper handling of special elements used in the template engine. This vulnerability may allow arbitrary code to execute, enabling attackers to gain elevated access or control over the victim’s account or session without requiri...

JetLinks IoT Platform: Authorization Issues Vulnerability

The JetLinks IoT Platform versions 2.10.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of @SaveAction authorization verification in the POST /device/transparent-codec/productId interface. Only users with the permission to query transparent-codecs c...

NSPC911 rovr command injection vulnerability

NSPC911 rovr 0.10.3 and earlier versions have a command injection vulnerability. This vulnerability occurs when opening malicious file names on Windows that contain shell metacharacters like "&" via openfile, potentially leading to OS command injection and execution with user privileges...

NETGEAR RAX30 Authorization Issue Vulnerability

NETGEAR RAX30, RAX29, and RAX28 v1.0.15.110 and earlier versions have an authorization issue vulnerability. This vulnerability stems from authentication bypass in the management services. Unauthenticated attackers can access the management services of affected devices with adjacent access rights,...

LiuYuYang01 ThriveX Server Authorization Issue Vulnerability

LiuYuYang01 ThriveX Server 4.0 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of authorization verification for the GET /api/article and /api/article/id endpoints. Unauthorized attackers can read the complete titles, descriptions, and conten...

Stone Wu’s authorization issues and vulnerabilities

Stone Wu’s Rongguang versions 1.2.0 and earlier have an authorization issue. This vulnerability stems from a lack of authorization checks. Unauthorized users, who are authenticated but not administrators, can access confidential information stored through the unprotected ApiConfigController and...

WordPress Link Whisper – Free SQL Injection Vulnerability

WordPress Link Whisper Free 0.9.7 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements in SQL commands, which may lead to blind SQL injections...

Mateaix MateCloud authorization issue vulnerability

Mateaix MateCloud 5.0.8 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of an authorization check. Any authenticated user can manage object storage by calling the unprotected/api/v1/admin/storage endpoint in StorageController. Users with low...

Siemens SIMATIC Drive Controller CPU 1504D TF cross-site scripting vulnerability

The Siemens SIMATIC Drive Controller CPU 1504D TF has a cross-site scripting vulnerability. This vulnerability stems from the failure to properly validate and clean up the visual marker data in the imported CSV tracking files. This could allow attackers to induce authorized users with the “Read...

WordPress Pay for Payment for WooCommerce authorization issue vulnerability

WordPress Pay for Payment in WooCommerce 3.0.1 and earlier versions has an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks, which may allow attackers to exploit improperly configured access control levels...

Natural Language Toolkit path traversal vulnerability

NLTK versions 3.10.3 and earlier have a path traversal vulnerability. This vulnerability arises from WekaClassifier not verifying the model path. Attackers can bypass the nltk.pathsec restriction by controlling the modelfilename or model parameter, allowing for path traversal. This may result in...

Stone Wu’s authorization issues and vulnerabilities

Stone Wu’s Rongguang versions 1.2.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references. Attackers can obtain the generated results of other users by providing arbitrary task IDs. They can also enumerate the auto-incrementing task...

Kavita: Server-side Request Forgery Vulnerability

In versions Kavita 0.9.0 to 0.9.1.4, there is a vulnerability related to server-side request forgery. This vulnerability arises from server-side request forgery attacks. Authorized attackers can bypass the SSRF blacklist by using DNS rebind or HTTPS redirection. They can submit malicious URLs via...

Joseph Huckaby xyOps Cross-Site Scripting Vulnerability

Joseph Huckaby’s xyOps version 0.9.119 and earlier contain a cross-site scripting vulnerability. This vulnerability arises from the fact that the administrator’s Activity Log includes the item.user.fullname value in the HTML code without proper entity encoding. Additionally, the pixl-server-user...

Microsoft SQL Server resource management error vulnerabilities

Microsoft SQL Server has a resource management vulnerability that arises from insufficient or ineffective restrictions on resource allocation. This vulnerability could allow authorized attackers to cause denial-of-service attacks through the network...

Xorbits Xoscar deserialization injection vulnerability

Xorbits Xoscar versions 0.11.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from the use of SocketChannel.recv, which passes unvalidated data to cloudpickle.loads. This triggers the pickle reduce utility before message type validation. Unauthorized remote...

LeapWorx Premium Addons for Elementor – Cross-site Script Vulnerabilities

LeapWorx Premium Addons for Elementor 4.11.110 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper handling of inputs during web page generation, which may lead to storage-type cross-site scripting attacks...

OpenText Endpoint Investigator Authorization Issue Vulnerability

OpenText Endpoint Investigator 26.1 and earlier versions, OpenText Endpoint Forensics & Response 26.1 and earlier versions, OpenText Information Assurance 26.1 and earlier versions, and OpenText Endpoint Security 24.1 and earlier versions have an authorization issue vulnerability. This...

Parse Platform Parse Server Conflict Issues Vulnerability

The Parse Platform, including versions from 5.4.0 to 8.6.96, as well as 9.0.0 to 9.10.2-alpha.5, have a concurrency issue involving shared transaction batch processing states. This issue allows for transaction batch processing requests from one client to interfere with database writes by other...

WordPress PowerPack Addons for Elementor: Cross-site Script Vulnerabilities

WordPress PowerPack Addons for Elementor 3.1.0 and earlier versions contain a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...

OpenCATS arbitrary file upload vulnerability

Versions of OpenCATS prior to 0.10.0 have a vulnerability related to arbitrary file uploads. This vulnerability stems from the Import module, specifically modules/import/ImportUI.php. This file retains the original name of the uploaded file and places it in a temporary directory accessible to the...

Siemens RUGGEDCOM CROSSBOW SQL injection vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a SQL injection vulnerability. This vulnerability stems from improper validation or cleaning of the filename of the uploaded firmware. It may allow authenticated attackers with specific privileges to execute arbitrary SQL commands on the...

Mistral AI Mistral Vibe processing logic error vulnerability

Mistral AI Mistral Vibe versions prior to 2.25.5 have a processing logic vulnerability. This vulnerability stems from differences in the parsing of escaped newline characters by the extractcommands function in bash.py between tree-sitter-bash and bash. As a result, permission verification is...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform’s Parse Server versions from 8.2.2 to 8.6.94 and from 9.0.0 to 9.10.1-alpha.14 contain authorization issue vulnerabilities. This vulnerability stems from GraphQL implicit control, which only applies to operations where requests are sent directly. It does not cover operations...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform, versions prior to 8.6.93 and 9.0.0 up to 9.10.1-alpha.13, have an authorization issue vulnerability. This vulnerability stems from the lack of enforcing the identity scope’s protectedFields during count queries using the $relatedTo operator. As a result, the size of the...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.95, as well as versions from 9.0.0 to 9.10.2-alpha.3, have a vulnerability related to improper exception handling. This vulnerability arises from the lack of parsing of URL references in files when objects are passed to Cloud Code triggers...

Jakub Vrána Adminer code injection vulnerability

Jakub Vrána’s versions prior to 6.1.1 have a code injection vulnerability. This vulnerability arises because authenticated SQLite users can bypass the ATTACH and VACUUM INTO restrictions by adding UTF-8 byte-order marks before the SQL statements. This could allow attackers to attach database file...

WordPress Event Post Authorization Issue Vulnerability

WordPress Event post 6.1.1 and earlier versions have a vulnerability related to authorization. This vulnerability stems from bypassing authorization through user-controlled keys. Attackers can exploit improperly configured access control levels, leading to unauthorized access...

WordPress Ad Inserter Cross-Site Script Vulnerability

WordPress Ad Inserter 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to stored-xss attacks...

Luke Jackson Servør path traversal vulnerability

Luke Jackson Servo versions 1.0.0 to 4.0.2 and earlier have a path traversal vulnerability. This vulnerability arises from the fact that decodeURI is executed before path.join in serveStaticFile and serveDirectoryListing. Attackers can send URL-encoded strings to escape the root directory, making...

Karuppiah Natarajan – Easy-PDF-Merge command injection vulnerability

Karuppiah Natarajan’s easy-pdf-merge tool versions from 0.1.0 to 0.2.6 and earlier contain a command injection vulnerability. This vulnerability stems from an OS command injection issue. Attackers can inject shell metacharacters into the source path, target path, or maxHeap option. By passing fil...

MikroTik RouterOS Authorization Issues Vulnerability

MikroTik RouterOS versions 7.0.0 to 7.24.5 have a vulnerability related to authorization. This vulnerability stems from improper authorization checks in the WinBox authentication process. Remotely authenticated users with low privileges can obtain full management access by specifying a...

mher flower Cross-Site Request Forgery Vulnerability

Mher Flower versions prior to 2.2.0 had a cross-site request forgeing vulnerability. This vulnerability stemmed from the Tornado xsrfcookies being disabled and the absence of the SameSite header in OAuth session cookies. This made it vulnerable to cross-site request forgeing attacks. Attackers...

JupyterHub processing logic vulnerability

JupyterHub 6.0.1 and earlier versions have a processing logic vulnerability caused by identifier conflicts. Users who have been authenticated can override another user’s named server OAuth client by using hyphenated usernames. For example, a user with the username “alice-prod” can override the...

Hatchet Resource Management Error Vulnerability

Hatchet versions 0.110.5 and earlier have a resource management vulnerability. This vulnerability stems from unlimited resource allocation. Unauthenticated attackers can send arbitrary or concurrent request bodies via the SNS ingestion endpoint to POST /api/v1/sns/tenant/event. The SnsUpdate...

Konstanty Bialkowski libmodplug resource management error vulnerability

The Konstanty Bialkowski libmodplug versions 0.8.9.0 and 0.8.9.1 have a resource management vulnerability. This vulnerability arises from manipulation of the abcaddgchord function in the file src/loadabc.cpp within the ABC Music Format Parser component, resulting in excessive resource consumption...

Highwarden Super Store Finder has a vulnerability in input validation.

Highwarden Super Store Finder versions 3.8 and earlier have a security vulnerability. This vulnerability stems from incorrect handling of the parameters lat/lng in the file /products/superstorefinder/index.php, which may lead to SQL injection attacks...

WordPress MultiVendorX Authorization Issues Vulnerability

WordPress MultiVendorX 5.0.19 and earlier versions have a vulnerability related to authorization. This vulnerability arises from improper authorization settings. Attackers with the storeowner role can send POST requests via the settings REST endpoint, limited only by the editstores permission,...

openagents-org openagents Authorization Issue Vulnerability

openagents-org has an authorization issue. This vulnerability stems from the lack of authentication for the GET /v1/workspaces interface, allowing unauthenticated attackers to list all workspaces. This may lead to the reading of sensitive information such as the unmasked browserfabricapikey, as...

Leo open-computer-use: Input validation error vulnerability

Leo’s open-computer-use software versions 1.0.0 and earlier contain a vulnerability related to input validation. This vulnerability stems from improper handling of case sensitivity, which could allow local MCP callers to bypass the password manager’s rejection list by using case-variant bundle...

Hyper-MCP encryption issue vulnerabilities

Hyper-MCP versions 0.8.3 and earlier have an encryption-related vulnerability. This vulnerability stems from the fact that cosignverifyargs accepts any signer identity and OIDC issuer by default. Improper signature verification may allow attackers to load malicious WebAssembly plugins, which can...

OpenDocMan resource management error vulnerability

Versions of OpenDocMan from 2.4.0 to 2.10.0 have a resource management vulnerability. This vulnerability stems from a decompression bomb issue. Certified users can exploit this vulnerability by uploading specially crafted ODT, DOCX, or XLSX files. The XML entries in these files will be decompress...

Studio Saelix Sencho authorization issue vulnerability

The Studio Saelix sencho 0.94.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the improper handling of the X-Forwarded-For parameter in the Login Endpoint component’s file/api/auth/login, resulting in improper authentication. A remote attacker could...

Everyone’s AI MoAI-ADK backend link vulnerability

The All-Users AI MoAI-ADK 3.1.2 and earlier versions have a post-link vulnerability. This vulnerability stems from improper link resolution in the moai init template deployer. Attackers can use symbolic links to the.moai-tmp temporary path to overwrite files outside of the project, causing...

Plastic Labs’ CEO authorization issue vulnerability

Plastic Labs versions 3.3.0 and earlier have an authorization issue. This vulnerability stems from improper authorization handling; the getorcreateworkspace function only checks the workspace declaration. As a result, holders of API keys with per-app or session scope can access workspace data...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...

WordPress Academy LMS has vulnerabilities related to permissions and access control systems.

WordPress Academy LMS versions 4.0.3 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities arise from the addchild function, which calls addrole'academystudent' on existing accounts before Store::link verifies the guardianship relationship...

WordPress PayPal deserialization injection vulnerability

WordPress Payee versions 4.8.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from unvalidated PHP object injections, which may lead to remote code execution...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

Themegoods DK authorization issue vulnerability

Themegoods DK 3.2.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control without authentication, which may allow attackers to modify data without proper authorization...