Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

dbcli mycli command injection vulnerability

Versions 2.29.0, 2.29.1, 2.29.2, 2.29.3, 2.29.4, 2.30.0, and 2.30.1 of dbcli mycli contain a command injection vulnerability. This vulnerability stems from an OS command injection flaw in the sourcespecialcommandissafe function within the file mycli/packages/special/source.py in the Whitelist...

KodCloud KodExplorer permission and access control issue vulnerability

KodCloud KodExplorer versions 4.55 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘path’ parameter in the file app/controller/editor.class.php within the Online Editor Save Endpoint component. As a result, unrestricted file uploads are possibl...

YesWiki SQL injection vulnerability

Versions prior to 4.7.0 of YesWiki contain an SQL injection vulnerability. This flaw arises because the datemajfiche field in Bazar entry creation requests within PageManager::save is concatenated into the INSERT statement without proper escaping. As a result, it is susceptible to SQL injection...

ImageMagick numeric error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a numerical error vulnerability. This vulnerability stems from a heap buffer overflow when requesting convex hull information on 32-bit systems. An attacker can supply specially crafted images processed via convex hull computation, thereby...

vLLM resource management error vulnerability

Versions vLLM from 0.18.0 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because the API client can bypass the maximum number of video/JPEG frames by using mediaiokwargs to set numframes to -1 and uploading large inline videos. As a...

Parse Platform Parse Server information disclosure vulnerability

Versions prior to Parse Platform Parse Server 8.6.103 and versions from 9.0.0 through 9.10.5-alpha.4 contain an information disclosure vulnerability. This vulnerability arises because LiveQuery’s subscription hash fails to respect constraints surrounding the $or operator, including the Session...

OpenRemote core authorization issue vulnerability

Versions of OpenRemote prior to 1.31.0 contain an authorization issue vulnerability. This vulnerability stems from authorization bypass, allowing authenticated users to retrieve gateway tunnel information for other realms via getGatewayActiveTunnelInfos. As a result, internal target hosts, ports,...

Pig-Mesh Pig input validation error vulnerability

Versions 4.0 and 4.1.0 of Pig Mesh contain a security vulnerability. This vulnerability stems from improper handling of the “ascs” and “descs” parameters in the orderItem.getColumn function within the file...

Grokability Snipe-IT authorization issue vulnerability

Versions of Grokability Snipe-IT prior to 8.6.3 contain an authorization issue vulnerability. This vulnerability stems from GoogleAuthController::handleGoogleCallback failing to enforce a check on the activation flag; as a result, deactivated users may log in via Google SSO and regain their...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/editdealer.php, which may lead to SQL injection...

YesWiki cross-site scripting vulnerability

Versions 4.2.0 through 4.7.0 of YesWiki contain a cross-site scripting vulnerability stemming from a stored XSS issue. Authenticated users can inject scripts into comment bodies via the wakka raw HTML syntax. Attackers can post comments using the /api/comments endpoint; however, Twig’s raw filter...

YesWiki server request forgery vulnerability

Versions prior to YesWiki 4.7.0 contain a server-side request forgery vulnerability. This vulnerability arises from unauthenticated server-side request forgery, allowing attackers to pass |URL wiki syntax to the render handler. By passing this syntax via the content parameter of the page’s render...

ProjectSend authorization issue vulnerability

Versions 2.0.0 through 2.7.1 of ProjectSend contain an authorization issue vulnerability. This vulnerability stems from incomplete authorization checks in FileVersions::link. Staff users can share files by linking to unauthorized file versions. Attackers can also link files to intermediate revisi...

SiYuan encryption issue vulnerability

Versions 3.6.0 through 3.8.7 of SiYuan contain an encryption vulnerability. This flaw arises because networkServeTLS settings are accepted and persisted but never enforced, allowing kernel ports to provide full API access via plain HTTP outside of HTTPS. Compromised attackers on adjacent networks...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

Mansi Khamkar Restaurant_IMS input validation error vulnerability

The Mansi Khamkar RestaurantIMS has a security vulnerability stemming from improper handling of the loginid/epsw parameters in the mysqliconnect function within the file lsmodal.php. This vulnerability can be exploited remotely and may lead to SQL injection...

SiYuan path traversal vulnerability

Versions prior to SiYuan 3.8.7 contain a path traversal vulnerability. This vulnerability stems from incomplete inclusion of sensitive file paths in the blacklist used by the validateAssetUploadPaths dependency within the MCP asset tool; files such as .env are omitted. As a result, authenticated...

SiYuan cross-site scripting vulnerability

Versions 2.9.0 through 3.8.7 of SiYuan contain a cross-site scripting vulnerability. This flaw arises because unauthenticated /check-auth pages assign the to parameter to window.location.href without performing protocol validation, potentially enabling cross-site scripting attacks. Attackers can...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from memory leaks occurring when various decoders process XMP configuration files. An attacker can supply an image containing a specially crafted...

RuoYi authorization issue vulnerability

Versions RuoYi 2026.09 and earlier contain an authorization issue vulnerability. This vulnerability stems from improper handling of the mobile/code parameter in the AuthController.java file within the SMS Code Verification component, leading to inadequate authentication. It may be exploited...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/adddealer.php, which may lead to SQL injection...

vLLM resource management error vulnerability

Versions vLLM from 0.8.5 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because LogprobsTensors.emptycpu allocates an uninitialized int32 tensor, and the V1 model runner fails to write the prompt location computed by the KV connector...

vLLM input validation error vulnerability

Versions vLLM 0.22.0 through 0.24.0 contain an input validation error vulnerability. This flaw stems from Rust’s gRPC frontends failing to properly restrict logprobtokenids. Remote attackers can exploit this by sending a Generate or GenerateStream request that enables outputlogprobs and contains...

YesWiki cross-site scripting vulnerability

Versions prior to YesWiki 4.7.0 contain a cross-site scripting vulnerability. This flaw arises because filtertags fails to encode output for token values controlled by attackers. Anonymous attackers can exploit this by injecting tags via the action-attribute parameter, thereby bypassing the...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the JNG encoder fails to release allocated memory when processing specially crafted images. Attackers can exploit this by providing a specially...

ImageMagick cross-site scripting vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a cross-site scripting vulnerability. This vulnerability arises because the MVG encoder fails to properly sanitize user-specified drawing options before writing them to the generated MVG output. As a result,...

KodCloud KodExplorer server request forgery vulnerability

KodCloud KodExplorer versions 4.56 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from an issue in the requesturlsafe function within the app/function/webfunction.php file in the Remote Download component, potentially allowing remote attackers to perform...

vLLM server request forgery vulnerability

Versions prior to vLLM 0.24.0, specifically version 0.9.2, contain a server-side request forgery vulnerability. This vulnerability arises from embedding a decoding address within the X-Request-Id header, enabling server-side request forgery. Attackers can pre-populate the P2pNcclConnector with...

Rclone input validation error vulnerability

Versions of Rclone from 1.52.0 through 1.75.2 contain an input validation error vulnerability. This vulnerability stems from the pCloud backend’s failure to verify the localhost OAuth callback status and trusting the hostname parameter. It makes the system susceptible to cross-site request forger...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from a lack of cleanup after a magick compare command fails, potentially leading to memory leaks. Attackers can exploit this by providing input that triggers repeated comparison...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from memory allocation used when processing the -cdl color decision list option without subsequent cleanup. An attacker can supply input to trigger this...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because PerlMagick fails to release returned values when reading image properties, resulting in memory leaks. Attackers can repeatedly trigger this behavior to exhaust memory and...

ONE ARMY authorization issue vulnerability

Versions prior to ONE ARMY 2.165.2 contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references; authenticated users can mark notifications from other users as read via POST /api/notifications/:id/read. Attackers can then iterate through consecutive...

WordPress Better Messages cross-site scripting vulnerability

WordPress Better Messages versions 3.1.3 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to DOM-based cross-site scripting attacks...

Tribulant Software Newsletters SQL injection vulnerability

Tribulant Software Newsletters versions 4.18.1 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

WordPress LiteSpeed Cache information disclosure vulnerability

WordPress LiteSpeed Cache versions 7.9 and earlier contain an information disclosure vulnerability. This vulnerability arises from inserting sensitive information into transmitted data, potentially allowing attackers to retrieve such embedded sensitive data...

phpIPAM cross-site scripting vulnerability

Versions 1.8.3 and earlier of phpIPAM contain a security vulnerability stemming from improper handling of the REQUESTURI parameter in the file upgrade/index.php; this may lead to cross-site scripting attacks...

QuarkA QA Analytics cross-site scripting vulnerability

QuarkA QA Analytics versions 5.3.0.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

YunaiV yudao-cloud authorization issue vulnerability

Versions 2026.09 and earlier of YunaiV yudao-cloud contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references within the mall trade module. Authentication members can exploit this by providing any valid afterSaleId value and enumerating subsequent...

Gitroom Postiz path traversal vulnerability

A security vulnerability exists in Gitroom Postiz versions from 2.23.0 up to and including 2.25.3. This vulnerability arises because media paths are not verified to be within the upload directory when publishing articles. As a result, registered users may store specially crafted media paths,...

Xinan Technology Xiaozhi-ESP32 Server Authorization Issue Vulnerability

Versions prior to 0.9.8 of Xinan Technology’s xiaozhi-esp32-server contain an authorization issue vulnerability. This vulnerability stems from an unsafe direct object reference in the DeviceController.getAddressBook handler within manager-api. Attackers can use either a regular account or a...

TravisUn Optrix resource management error vulnerability

TravisUn Optrix version 0.4.0 contains a resource management error vulnerability. This vulnerability stems from improper handling of the Buffer.concat function in the file /api/channels/webhook/ within the preParsing handler component, potentially leading to remote denial of service...

Open62541 Digital error vulnerability

In versions prior to 1.5.7 of Open62541, there is a numeric error vulnerability. This vulnerability arises because UADataTypefromStructureDescription experiences an integer overflow when processing large custom structure definitions; it then wraps around the 16-bit memSize field. A malicious OPC ...

WordPress Eventin cross-site scripting vulnerability

WordPress Eventin versions 4.1.26 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation, potentially enabling stored cross-site scripting attacks...

Noah Hearle Cross-site Scripting Vulnerability

Noah Hearle: Versions 2.6 and earlier of “We’re Open” contain a cross-site scripting vulnerability caused by improper input handling during web page generation; this makes them susceptible to reflected XSS attacks...

WordPress VikRentCar Car Rental Management System cross-site scripting vulnerability

WordPress VikRentCar Car Rental Management System versions 1.4.8 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to stored cross-site scripting attacks...

WordPress CleanTalk Anti cross-site scripting vulnerability

WordPress CleanTalk Anti versions 6.89.1 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping; it results in stored cross-site scripting via the ‘useremail’ parameter. Unauthenticated attackers can inject arbitrary web...

Mervin Praison PraisonAI processing logic error vulnerability

A security vulnerability exists in Mervin Praison PraisonAI versions from 4.5.87 up to and including 4.6.59. This vulnerability arises because the recipe.runstream stream execution path fails to perform checks on dangerous tools, allowing recipes declared as executecommand to bypass restrictions ...

Twisted input validation error vulnerability

Versions of Twisted prior to 26.7.0rc1 contain an input validation error vulnerability. This vulnerability arises because twisted.names.dns.DNSDatagramProtocol only validates the 16-bit transaction ID without verifying whether the DNS response originates from the requested host and port. An...