SiYuan encryption issue vulnerability

Versions 3.6.0 through 3.8.7 of SiYuan contain an encryption vulnerability. This flaw arises because networkServeTLS settings are accepted and persisted but never enforced, allowing kernel ports to provide full API access via plain HTTP outside of HTTPS. Compromised attackers on adjacent networks...

Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

YesWiki cross-site scripting vulnerability

Versions prior to YesWiki 4.7.0 contain a cross-site scripting vulnerability. This flaw arises because filtertags fails to encode output for token values controlled by attackers. Anonymous attackers can exploit this by injecting tags via the action-attribute parameter, thereby bypassing the...

YesWiki SQL injection vulnerability

Versions prior to 4.7.0 of YesWiki contain an SQL injection vulnerability. This flaw arises because the datemajfiche field in Bazar entry creation requests within PageManager::save is concatenated into the INSERT statement without proper escaping. As a result, it is susceptible to SQL injection...

vLLM input validation error vulnerability

Versions vLLM 0.22.0 through 0.24.0 contain an input validation error vulnerability. This flaw stems from Rust’s gRPC frontends failing to properly restrict logprobtokenids. Remote attackers can exploit this by sending a Generate or GenerateStream request that enables outputlogprobs and contains...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

SiYuan path traversal vulnerability

Versions prior to SiYuan 3.8.7 contain a path traversal vulnerability. This vulnerability stems from incomplete inclusion of sensitive file paths in the blacklist used by the validateAssetUploadPaths dependency within the MCP asset tool; files such as .env are omitted. As a result, authenticated...

ONE ARMY authorization issue vulnerability

Versions prior to ONE ARMY 2.165.2 contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references; authenticated users can mark notifications from other users as read via POST /api/notifications/:id/read. Attackers can then iterate through consecutive...

WordPress Eventin cross-site scripting vulnerability

WordPress Eventin versions 4.1.26 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation, potentially enabling stored cross-site scripting attacks...

Open62541 Digital error vulnerability

In versions prior to 1.5.7 of Open62541, there is a numeric error vulnerability. This vulnerability arises because UADataTypefromStructureDescription experiences an integer overflow when processing large custom structure definitions; it then wraps around the 16-bit memSize field. A malicious OPC ...

Noah Hearle Cross-site Scripting Vulnerability

Noah Hearle: Versions 2.6 and earlier of “We’re Open” contain a cross-site scripting vulnerability caused by improper input handling during web page generation; this makes them susceptible to reflected XSS attacks...

WordPress Better Messages cross-site scripting vulnerability

WordPress Better Messages versions 3.1.3 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to DOM-based cross-site scripting attacks...

Tribulant Software Newsletters SQL injection vulnerability

Tribulant Software Newsletters versions 4.18.1 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.9. It arises when IPv4 FIB dumps are concurrently executed alongside nexthop replacement; no check is performed to verify whether an index path exists. As a result, fibinfonhc may return NULL and be dereferenced via nhcflags, leading to a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions from 6.6.79 up to 6.6.160, from 6.12.16 up to 6.12.113, from 5.15.179 up to 5.16, from 6.1.129 up to 6.2, and specifically in version 6.13. This vulnerability arises because PMTU traversal is not halted when the nexthop group contracts; as ...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.12.34, from 6.15.3 up to but including 6.16, and specifically in version 6.16. This vulnerability stems from the failure of vsock/virtio’s readskb to properly count unread bytes after receiving part of a stream...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 3.16. It arises because memstickcheck checks before setting eject/removing; subsequent requests are silently discarded without any action being taken, causing the removal process to hang and blocking the work queue...

OLo Uni-CLI input validation error vulnerability

A security vulnerability exists in OLo Uni-CLI versions prior to 0.225.2. This vulnerability arises because when old JSON-RPC-over-HTTP MCP transmissions are exposed to the loopback address, the browser Origin header is not validated prior to routing requests. As a result, malicious web pages can...

baserproject baserCMS deserialization injection vulnerability

BaserProject baserCMS versions prior to 5.0.0 and 5.3.2, as well as versions prior to 5.4.0 and 5.4.2, contain a deserialization injection vulnerability. This vulnerability arises because the widget-area entity serializes controls only when the submission value is an array. As a result, strings...

baserproject baserCMS arbitrary file upload vulnerability

BaserProject baserCMS versions prior to 5.0.0-beta1 and 5.3.2, as well as versions 5.4.0 and 5.4.2, contain an arbitrary file upload vulnerability. This vulnerability arises because PermissionGroupsService::build writes wildcard allow rules when the plugin lacks config/permission.php, allowing th...

The-40-Thieves obsidian-tc resource management error vulnerability

Versions 1.0.1 through 1.31.4 of The-40-Thieves obsidian-tc contain a security vulnerability. This vulnerability arises because createentity, linkentities, renameentity, unlinkentities, and deleteentity fail to properly preserve ownership of notes when re-generating memory notes via the path...

WordPress VikRentCar Car Rental Management System cross-site scripting vulnerability

WordPress VikRentCar Car Rental Management System versions 1.4.8 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to stored cross-site scripting attacks...

WordPress CleanTalk Anti cross-site scripting vulnerability

WordPress CleanTalk Anti versions 6.89.1 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping; it results in stored cross-site scripting via the ‘useremail’ parameter. Unauthenticated attackers can inject arbitrary web...

Part-DB authorization issue vulnerability

Versions prior to Part-DB 2.13.3 contain an authorization issue vulnerability. This vulnerability arises when a password reset link is generated based on the HTTP Host header provided by the client without verifying its authenticity; as a result, unauthenticated attackers can forge the Host heade...

Mervin Praison PraisonAI cross-site scripting vulnerability

Versions 4.5.2 through 4.6.59 of Mervin Praison PraisonAI contain a cross-site scripting vulnerability. This flaw arises because HTTPApproval directly renders tool parameters awaiting approval into the HTML of the approval dashboard. Attackers can inject JavaScript via these controllable...

Mervin Praison PraisonAI processing logic error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.5.87 up to and including 4.6.59. This vulnerability arises because the recipe.runstream stream execution path fails to perform checks on dangerous tools, allowing recipes declared as executecommand to bypass restrictions ...

Stape GTM Server Side Plugin information disclosure vulnerability

Versions 2.0.0 through 2.1.48 of the Stape GTM Server Side Plugin contain an information disclosure vulnerability. This vulnerability arises because WooCommerce’s purchase event tracking mechanism allows unauthenticated attackers to render JavaScript data layers containing full order details...

OpenWRT odhcpd buffer error vulnerability

OpenWRT odhcpd versions 25.12 and earlier contain a buffer error vulnerability. This vulnerability arises because DHCPv6 self-loop detection directly uses the network byte-order length value of the DUID as the argument to memcmp at dhcpv6.c:720. On little-endian hosts, this may result in reading...

Mervin Praison PraisonAI permission and access control issue vulnerability

Versions 4.5.110 through 4.6.61 of Mervin Praison PraisonAI contain a security vulnerability. This vulnerability arises because SandlockSandbox fails to shut down upon encountering Landlock; instead, it reverts to SubprocessSandbox. As a result, file systems and network boundaries are not enforce...

Mervin Praison PraisonAI command injection vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.6.10 up to but not including 4.6.59. This vulnerability stems from LocalManagedAgent / SandboxedAgent calculation bridging, which constructs shell commands using raw path parameters when processing readfile, listfiles, an...

Zimbra Collaboration Suite cross-site scripting vulnerability

Versions 10.1.16 and 10.1.17 of the Zimbra Collaboration Suite contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of the zrememberme parameter on the login page; the parameter is inserted into hidden input fields without HTML encoding. This may lead to...

Zimbra Collaboration Suite input validation error vulnerability

Versions 10.1.16 and 10.1.21 of the Zimbra Collaboration Suite contain an input validation error vulnerability stemming from LDAP filter injection. Zimbra escapes search values but fails to validate them, allowing attribute names to be directly inserted into LDAP filter expressions. Attackers can...

HP One Agent permission and access control issue vulnerability

Versions of HP One Agent prior to 1.87.4769.0 contain a privilege escalation and access control vulnerability stemming from uncontrolled search path elements, which may lead to privilege escalation and/or arbitrary code execution...

Zimbra Collaboration Suite authorization issue vulnerability

Zimbra Collaboration Suite versions 10.1.21 and earlier contain an authorization issue vulnerability. This vulnerability arises when a null sender identity is passed during processing of the iCalendar REPLY component, causing the participant authorization filter to be bypassed. As a result,...

OpenStack Ironic permission and access control issues vulnerability

Vulnerabilities related to permission and access control exist in OpenStack Ironic versions from 17.0.0 up to and including 29.1.1, from 30.0.0 up to and including 32.1.1, from 33.0.0 up to and including 35.1.1, and from 36.0.0 up to and including 39.0.1. These vulnerabilities arise because users...

WizLearn Technologies Learning Management System security vulnerability

The WizLearn Technologies Learning Management System contains a security vulnerability stemming from an authentication bypass issue. Remote attackers can exploit this by sending specially crafted POST requests, thereby bypassing both password and OAuth authentication mechanisms. This could result...

Kavita path traversal vulnerability

Versions Kavita 0.5.2 through 0.5.4.1 contain a path traversal vulnerability. This vulnerability arises because the filename parameter allows path traversal; unauthenticated attackers can send GET requests containing ../ sequences to /api/image/cover-upload to read any file outside the temporary...

Drupal Webform authorization issue vulnerability

Versions of Drupal Webform prior to 6.2.12 and from 6.3.0 up to but including 6.3.1 contain an authorization issue vulnerability. This vulnerability stems from improper authorization checks and may lead to forced browsing...

Bytecode Alliance wasmtime post-link vulnerability

Versions of Wasmtime prior to 24.0.13, from 25.0.0 up to versions prior to 36.0.14, from 37.0.0 up to versions prior to 46.0.3, and from 47.0.0 up to versions prior to 47.0.4 contain a post-link vulnerability. This vulnerability arises because cap-std’s dependency fails to properly handle symboli...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because the AppRole authentication method fails to verify whether a Secret ID has expired; as a result, expired Secret IDs remain valid until they are periodicall...

LXC Incus authorization issue vulnerability

Versions prior to LXC Incus 6.0.7, from 6.1.0 up to versions prior to 7.0.2, and from 7.1.0 up to versions prior to 7.5.0 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks on GET /1.0/operations/uuid. It may allow clients with restricted...

OpenBao log information leakage vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a log information leakage vulnerability. This occurs when request audit logs are successfully recorded but response audit logs fail to be recorded; as a result, no response audit entries are written for unauthenticated...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR has an authorization issue vulnerability. This vulnerability stems from improper authorization checks during conditional creation operations. Users lacking both CREATE and READ permissions can submit conditional creation requests that match existing resources via...

Hsiaoming Yang mistune resource management error vulnerability

Hsiaoming Yang’s Mistune contains a resource management error vulnerability. This vulnerability stems from an inefficient algorithm complexity issue in the parselinktext function. Remote attackers can exploit it by submitting markdown containing numerous mismatched brackets, triggering repeated...

MongoDB C# Driver numeric error vulnerability

A numeric error vulnerability exists in MongoDB C Driver versions 2.0.0 through 3.13.0. This vulnerability stems from a flaw in the BSON processing library regarding numerical type conversion. Untrusted text inputs containing boundary values for binary subtype types can bypass integrity checks on...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

oretnom23 php-travel-agency-system input validation error vulnerability

The oretnom23 php-travel-agency-system contains a security vulnerability stemming from improper handling of parameters costomerid/paymenttype/amount/description/user/uploadimage/fullname/visano in the admin/insert.php file, which may lead to SQL injection...

MongoDB C# Driver processing logic error vulnerability

Versions 1.8.0 through 3.13.0 of the MongoDB C Driver contain a logic error vulnerability. This vulnerability arises because, when determining whether two clients can share a cache connection, only the issuer and serial number are compared for TLS client certificates. As a result, an attacker who...

OpenVPN 3 Core Library encryption issue vulnerability

Versions 3.4 through 3.11.7 of the OpenVPN 3 Core Library contain an encryption vulnerability stemming from improper certificate validation. This vulnerability may allow attackers to bypass restrictions on the use of extended keys...

CrawlSEO server-side request forgery vulnerability

Versions prior to 0.2.4 of crawlseo contain a server-side request forgery vulnerability. This vulnerability arises because the isPrivateIp function within its crawler engine fails to block IP address ranges, and unverified addresses are not fixed for actual outbound connections. As a result,...