lmfit ASTEVAL processing logic error vulnerability

The lmfit ASTEVAL version prior to 1.0.9 has security vulnerabilities. These vulnerabilities stem from the default interpreter, which exposes the ctypes type when numpy is enabled. This allows access to memory through the fromaddress function. The safegetattr function does not intercept objects...

Siemens RUGGEDCOM CROSSBOW processing logic error vulnerability

Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 have a processing logic vulnerability. This vulnerability stems from the failure to properly execute server-side authorization checks for requests that modify the operation status of plans. As a result, authenticated attackers with minimal...

Kerwin FastBee authorization issue vulnerability

Kerwin FastBee versions 2.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DeviceController. Certified low-privilege users can read and modify devices of other tenants by providing the sequential device ID...

JetLinks IoT Platform: Authorization Issues Vulnerability

The JetLinks IoT Platform versions 2.10.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of @SaveAction authorization verification in the POST /device/transparent-codec/productId interface. Only users with the permission to query transparent-codecs c...

TRENDnet tew-432brp firmware buffer error vulnerability

TRENDnet tew-432brp firmware version 3.10B20 contains a buffer error vulnerability. This vulnerability stems from the operation of the parameter Name in the function formTcpipSetup within the file /goform/formTcpipSetup. It may lead to a stack buffer overflow, and attackers could exploit this...

Schneider Electric Sage RTU 1410 input validation error vulnerability

The Schneider Electric Sage RTU 1410, Sage RTU 1430, Sage RTU 1450, Sage RTU 2400, Sage RTU 3030 Magnum, and Sage RTU 4400 C3414-500-S02L0 previous versions have a vulnerability related to input validation errors. This vulnerability stems from insufficient data authenticity verification, which ma...

Mistral AI Mistral Vibe processing logic error vulnerability

Mistral AI Mistral Vibe versions prior to 2.25.4 have a processing logic vulnerability. This vulnerability stems from bypassing command permissions. Attackers can exploit this by hiding commands within single-quoted variables and re-expanding them using the $var@P prompt conversion operator,...

Logius DigiD for macOS security vulnerabilities

Logius DigiD versions prior to 6.19.2 contain a security vulnerability. This vulnerability stems from the fact that the application does not use Hardened Runtime signatures. Local processes can load their own dylibs into DigiD through DYLDINSERTLIBRARIES. Attackers with local user-level code...

TYPO3 CMS Permission Authorization and Access Control Vulnerabilities

The TYPO3 CMS versions from 14.0.0 to 14.3.8 have security vulnerabilities. These vulnerabilities arise from using the FileUpload or ImageUpload elements in forms that configure a custom saveToFileMount setting. As a result, uploaded files are stored in the default storage folder 1:/userupload/,...

Mistral AI Mistral Vibe processing logic error vulnerability

Mistral AI Mistral Vibe versions prior to 2.25.5 have a processing logic vulnerability. This vulnerability stems from differences in the parsing of escaped newline characters by the extractcommands function in bash.py between tree-sitter-bash and bash. As a result, permission verification is...

oauthlib Cross-Site Scripting Vulnerability

The oauthlib version 0.6.1 up to 4.0.0 had a cross-site scripting vulnerability. This vulnerability stemmed from RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py. When enablejsonp=True, RevocationEndpoint did not validate the callback request parameter and reflected it into...

mher flower Cross-Site Request Forgery Vulnerability

Mher Flower versions prior to 2.2.0 had a cross-site request forgeing vulnerability. This vulnerability stemmed from the Tornado xsrfcookies being disabled and the absence of the SameSite header in OAuth session cookies. This made it vulnerable to cross-site request forgeing attacks. Attackers...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform’s Parse Server versions from 8.2.2 to 8.6.94 and from 9.0.0 to 9.10.1-alpha.14 contain authorization issue vulnerabilities. This vulnerability stems from GraphQL implicit control, which only applies to operations where requests are sent directly. It does not cover operations...

Parse Platform Parse Server Authorization Vulnerability

The Parse Platform, versions prior to 8.6.93 and 9.0.0 up to 9.10.1-alpha.13, have an authorization issue vulnerability. This vulnerability stems from the lack of enforcing the identity scope’s protectedFields during count queries using the $relatedTo operator. As a result, the size of the...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.95, as well as versions from 9.0.0 to 9.10.2-alpha.3, have a vulnerability related to improper exception handling. This vulnerability arises from the lack of parsing of URL references in files when objects are passed to Cloud Code triggers...

Jakub Vrána Adminer code injection vulnerability

Jakub Vrána’s versions prior to 6.1.1 have a code injection vulnerability. This vulnerability arises because authenticated SQLite users can bypass the ATTACH and VACUUM INTO restrictions by adding UTF-8 byte-order marks before the SQL statements. This could allow attackers to attach database file...

WordPress Event Post Authorization Issue Vulnerability

WordPress Event post 6.1.1 and earlier versions have a vulnerability related to authorization. This vulnerability stems from bypassing authorization through user-controlled keys. Attackers can exploit improperly configured access control levels, leading to unauthorized access...

Karuppiah Natarajan – Easy-PDF-Merge command injection vulnerability

Karuppiah Natarajan’s easy-pdf-merge tool versions from 0.1.0 to 0.2.6 and earlier contain a command injection vulnerability. This vulnerability stems from an OS command injection issue. Attackers can inject shell metacharacters into the source path, target path, or maxHeap option. By passing fil...

MikroTik RouterOS Authorization Issues Vulnerability

MikroTik RouterOS versions 7.0.0 to 7.24.5 have a vulnerability related to authorization. This vulnerability stems from improper authorization checks in the WinBox authentication process. Remotely authenticated users with low privileges can obtain full management access by specifying a...

TRENDnet tew-751dr command injection vulnerability

TRENDnet tew-751dr, TEW-752DRU, and TEW733GR versions 1.03B01 and 1.03B03 have a command injection vulnerability. This vulnerability stems from incorrect parameter handling in the fwrite function of the file pigwidgeon.cgi within the Web Management Backend component. It may lead to OS command...

JackQ XCMS input validation error vulnerability

The JackQ XCMS 3fab5342cc509945a7ce1b8ec39d19f701b89261 and previous versions have security vulnerabilities. These vulnerabilities stem from improper handling of parameters in the PublicController::sendFindPwdMail function within the Password Recovery Mail Endpoint component. This improper handli...

Open Source Social Network Authorization Issue Vulnerability

The Open Source Social Network has an authorization vulnerability. This vulnerability stems from a lack of authorization checks in the ossnalbumpagehandler module. Without any access validation, unverified attackers can download files through the album/getphoto and album/getcover paths. They can...

Luke Jackson Servør path traversal vulnerability

Luke Jackson Servo versions 1.0.0 to 4.0.2 and earlier have a path traversal vulnerability. This vulnerability arises from the fact that decodeURI is executed before path.join in serveStaticFile and serveDirectoryListing. Attackers can send URL-encoded strings to escape the root directory, making...

WordPress Ad Inserter Cross-Site Script Vulnerability

WordPress Ad Inserter 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to stored-xss attacks...

Plastic Labs’ CEO authorization issue vulnerability

Plastic Labs versions 3.3.0 and earlier have an authorization issue. This vulnerability stems from improper authorization handling; the getorcreateworkspace function only checks the workspace declaration. As a result, holders of API keys with per-app or session scope can access workspace data...

JupyterHub processing logic vulnerability

JupyterHub 6.0.1 and earlier versions have a processing logic vulnerability caused by identifier conflicts. Users who have been authenticated can override another user’s named server OAuth client by using hyphenated usernames. For example, a user with the username “alice-prod” can override the...

Hatchet Resource Management Error Vulnerability

Hatchet versions 0.110.5 and earlier have a resource management vulnerability. This vulnerability stems from unlimited resource allocation. Unauthenticated attackers can send arbitrary or concurrent request bodies via the SNS ingestion endpoint to POST /api/v1/sns/tenant/event. The SnsUpdate...

Highwarden Super Store Finder has a vulnerability in input validation.

Highwarden Super Store Finder versions 3.8 and earlier have a security vulnerability. This vulnerability stems from incorrect handling of the parameters lat/lng in the file /products/superstorefinder/index.php, which may lead to SQL injection attacks...

WordPress MultiVendorX Authorization Issues Vulnerability

WordPress MultiVendorX 5.0.19 and earlier versions have a vulnerability related to authorization. This vulnerability arises from improper authorization settings. Attackers with the storeowner role can send POST requests via the settings REST endpoint, limited only by the editstores permission,...

openagents-org openagents Authorization Issue Vulnerability

openagents-org has an authorization issue. This vulnerability stems from the lack of authentication for the GET /v1/workspaces interface, allowing unauthenticated attackers to list all workspaces. This may lead to the reading of sensitive information such as the unmasked browserfabricapikey, as...

Hyper-MCP encryption issue vulnerabilities

Hyper-MCP versions 0.8.3 and earlier have an encryption-related vulnerability. This vulnerability stems from the fact that cosignverifyargs accepts any signer identity and OIDC issuer by default. Improper signature verification may allow attackers to load malicious WebAssembly plugins, which can...

OpenDocMan resource management error vulnerability

Versions of OpenDocMan from 2.4.0 to 2.10.0 have a resource management vulnerability. This vulnerability stems from a decompression bomb issue. Certified users can exploit this vulnerability by uploading specially crafted ODT, DOCX, or XLSX files. The XML entries in these files will be decompress...

Studio Saelix Sencho authorization issue vulnerability

The Studio Saelix sencho 0.94.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the improper handling of the X-Forwarded-For parameter in the Login Endpoint component’s file/api/auth/login, resulting in improper authentication. A remote attacker could...

Everyone’s AI MoAI-ADK backend link vulnerability

The All-Users AI MoAI-ADK 3.1.2 and earlier versions have a post-link vulnerability. This vulnerability stems from improper link resolution in the moai init template deployer. Attackers can use symbolic links to the.moai-tmp temporary path to overwrite files outside of the project, causing...

Konstanty Bialkowski libmodplug resource management error vulnerability

The Konstanty Bialkowski libmodplug versions 0.8.9.0 and 0.8.9.1 have a resource management vulnerability. This vulnerability arises from manipulation of the abcaddgchord function in the file src/loadabc.cpp within the ABC Music Format Parser component, resulting in excessive resource consumption...

Leo open-computer-use: Input validation error vulnerability

Leo’s open-computer-use software versions 1.0.0 and earlier contain a vulnerability related to input validation. This vulnerability stems from improper handling of case sensitivity, which could allow local MCP callers to bypass the password manager’s rejection list by using case-variant bundle...

WordPress Contact Form 7 has a vulnerability related to information leakage.

WordPress Contact Form 7 versions 5.0.7 and earlier have a vulnerability that leads to information leakage. This vulnerability occurs due to the exposure of sensitive data without authentication, which may result in the disclosure of sensitive information...

WordPress SpeedyCache information leakage vulnerability

WordPress SpeedyCache 1.4.2 and earlier versions have a vulnerability related to information leakage. This vulnerability arises from improper handling of the 'commentauthor' and 'commentauthoremail' parameters. The writing path lacks checks for the 'commentauthor' cookie, allowing malicious...

OpenLIT authorization issue vulnerabilities

OpenLIT 2.1.0 version has an authorization issue vulnerability. This vulnerability arises from bypassing authorizations by using a forged x-OpenLIT-project-id header. As a result, authenticated users may access telemetry data from other projects, including LLM prompts and completion content...

Mymoun Backhoe Code Injection Vulnerability

The Mymoun Backhoe 2.0 and earlier versions have a code injection vulnerability, which stems from unvalidated local file inclusion...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...

WordPress Academy LMS has vulnerabilities related to permissions and access control systems.

WordPress Academy LMS versions 4.0.3 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities arise from the addchild function, which calls addrole'academystudent' on existing accounts before Store::link verifies the guardianship relationship...

WordPress PayPal deserialization injection vulnerability

WordPress Payee versions 4.8.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from unvalidated PHP object injections, which may lead to remote code execution...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

Themegoods DK authorization issue vulnerability

Themegoods DK 3.2.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control without authentication, which may allow attackers to modify data without proper authorization...

WordPress Payment Processing via MetaMask for WooCommerce: Input Validation Vulnerability

WordPress payments via MetaMask for WooCommerce versions 1.7.2 and earlier have a vulnerability related to input validation errors. This vulnerability stems from unvalidated bypass attempts...

Themegoods Grand News Authorization Issue Vulnerability

Themegoods Grand News versions 3.4 and earlier have a vulnerability related to authorization issues. This vulnerability arises because unverified attackers can exploit improper access control mechanisms, allowing unauthorized modifications to data...

WordPress GeoDirectory code injection vulnerability

WordPress GeoDirectory 2.8.187 and earlier versions have a code injection vulnerability. This vulnerability stems from the designtype parameter, which involves local file inclusion. It may allow unauthenticated attackers to include and execute any.php file on the server, thereby bypassing access...

WordPress Booking System SQL Injection Vulnerability

The WordPress Booking System 2.1.0.1 and earlier versions have a SQL injection vulnerability. This vulnerability arises from insufficient escaping of the currentmonth parameter provided to users, as well as inadequate preparation of existing SQL queries. This leads to time-based SQL injections...

OpenPanel input validation error vulnerability

OpenPanel 2.3.0 and earlier versions have a vulnerability related to input validation errors. This vulnerability stems from CSV formula injections. Unverified attackers can exploit this flaw by providing a custom profile ID as part of the /track endpoint, allowing them to inject spreadsheet...