Parse Platform Parse Server permission and access control issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from memory allocation used when processing the -cdl color decision list option without subsequent cleanup. An attacker can supply input to trigger this...

Rclone input validation error vulnerability

Versions of Rclone from 1.52.0 through 1.75.2 contain an input validation error vulnerability. This vulnerability stems from the pCloud backend’s failure to verify the localhost OAuth callback status and trusting the hostname parameter. It makes the system susceptible to cross-site request forger...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises from a lack of cleanup after a magick compare command fails, potentially leading to memory leaks. Attackers can exploit this by providing input that triggers repeated comparison...

YesWiki SQL injection vulnerability

Versions prior to 4.7.0 of YesWiki contain an SQL injection vulnerability. This flaw arises because the datemajfiche field in Bazar entry creation requests within PageManager::save is concatenated into the INSERT statement without proper escaping. As a result, it is susceptible to SQL injection...

ImageMagick numeric error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a numerical error vulnerability. This vulnerability stems from a heap buffer overflow when requesting convex hull information on 32-bit systems. An attacker can supply specially crafted images processed via convex hull computation, thereby...

vLLM resource management error vulnerability

Versions vLLM from 0.18.0 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because the API client can bypass the maximum number of video/JPEG frames by using mediaiokwargs to set numframes to -1 and uploading large inline videos. As a...

Parse Platform Parse Server information disclosure vulnerability

Versions prior to Parse Platform Parse Server 8.6.103 and versions from 9.0.0 through 9.10.5-alpha.4 contain an information disclosure vulnerability. This vulnerability arises because LiveQuery’s subscription hash fails to respect constraints surrounding the $or operator, including the Session...

Grokability Snipe-IT authorization issue vulnerability

Versions of Grokability Snipe-IT prior to 8.6.3 contain an authorization issue vulnerability. This vulnerability stems from GoogleAuthController::handleGoogleCallback failing to enforce a check on the activation flag; as a result, deactivated users may log in via Google SSO and regain their...

SiYuan encryption issue vulnerability

Versions 3.6.0 through 3.8.7 of SiYuan contain an encryption vulnerability. This flaw arises because networkServeTLS settings are accepted and persisted but never enforced, allowing kernel ports to provide full API access via plain HTTP outside of HTTPS. Compromised attackers on adjacent networks...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

SiYuan path traversal vulnerability

Versions prior to SiYuan 3.8.7 contain a path traversal vulnerability. This vulnerability stems from incomplete inclusion of sensitive file paths in the blacklist used by the validateAssetUploadPaths dependency within the MCP asset tool; files such as .env are omitted. As a result, authenticated...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from memory leaks occurring when various decoders process XMP configuration files. An attacker can supply an image containing a specially crafted...

vLLM resource management error vulnerability

Versions vLLM from 0.8.5 up to but not including 0.31.0 contain a resource management error vulnerability. This vulnerability arises because LogprobsTensors.emptycpu allocates an uninitialized int32 tensor, and the V1 model runner fails to write the prompt location computed by the KV connector...

vLLM input validation error vulnerability

Versions vLLM 0.22.0 through 0.24.0 contain an input validation error vulnerability. This flaw stems from Rust’s gRPC frontends failing to properly restrict logprobtokenids. Remote attackers can exploit this by sending a Generate or GenerateStream request that enables outputlogprobs and contains...

YesWiki cross-site scripting vulnerability

Versions prior to YesWiki 4.7.0 contain a cross-site scripting vulnerability. This flaw arises because filtertags fails to encode output for token values controlled by attackers. Anonymous attackers can exploit this by injecting tags via the action-attribute parameter, thereby bypassing the...

ImageMagick cross-site scripting vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a cross-site scripting vulnerability. This vulnerability arises because the MVG encoder fails to properly sanitize user-specified drawing options before writing them to the generated MVG output. As a result,...

KodCloud KodExplorer server request forgery vulnerability

KodCloud KodExplorer versions 4.56 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from an issue in the requesturlsafe function within the app/function/webfunction.php file in the Remote Download component, potentially allowing remote attackers to perform...

vLLM server request forgery vulnerability

Versions prior to vLLM 0.24.0, specifically version 0.9.2, contain a server-side request forgery vulnerability. This vulnerability arises from embedding a decoding address within the X-Request-Id header, enabling server-side request forgery. Attackers can pre-populate the P2pNcclConnector with...

ImageMagick resource management error vulnerability

Versions of ImageMagick prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because PerlMagick fails to release returned values when reading image properties, resulting in memory leaks. Attackers can repeatedly trigger this behavior to exhaust memory and...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/adddealer.php, which may lead to SQL injection...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the MSL decoder fails to release allocated memory when processing specially crafted MSL images, potentially leading to memory leaks...

Privoce VoceChat cross-site scripting vulnerability

Privoce VoceChat versions 0.9.121 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the “welcome” parameter by the Query Parameter Handler component in the widget.html file, potentially enabling cross-site scripting attacks...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and versions prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability stems from uncontrolled recursion in the MVG decoder, potentially leading to a stack overflow. When an attacker supplies a specially crafted MVG file an...

ImageMagick processing logic error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-32 contain a logic error vulnerability stemming from an incomplete fix for policy bypass issues. This allows security policy bypass, enabling attackers to circumvent configuration restrictions that would otherwise prevent certain...

Krupal Employee Recruitment System input validation error vulnerability

The Krupal Employee Recruitment System has a security vulnerability stemming from improper handling of the pemail parameter in the file /source/registerform3.php within its Registration component. This flaw may lead to SQL injection, allowing attackers to launch remote attacks...

YesWiki cross-site scripting vulnerability

Versions 4.2.0 through 4.7.0 of YesWiki contain a cross-site scripting vulnerability stemming from a stored XSS issue. Authenticated users can inject scripts into comment bodies via the wakka raw HTML syntax. Attackers can post comments using the /api/comments endpoint; however, Twig’s raw filter...

KodCloud KodExplorer permission and access control issue vulnerability

KodCloud KodExplorer versions 4.55 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘path’ parameter in the file app/controller/editor.class.php within the Online Editor Save Endpoint component. As a result, unrestricted file uploads are possibl...

OpenRemote core authorization issue vulnerability

Versions of OpenRemote prior to 1.31.0 contain an authorization issue vulnerability. This vulnerability stems from authorization bypass, allowing authenticated users to retrieve gateway tunnel information for other realms via getGatewayActiveTunnelInfos. As a result, internal target hosts, ports,...

dbcli mycli command injection vulnerability

Versions 2.29.0, 2.29.1, 2.29.2, 2.29.3, 2.29.4, 2.30.0, and 2.30.1 of dbcli mycli contain a command injection vulnerability. This vulnerability stems from an OS command injection flaw in the sourcespecialcommandissafe function within the file mycli/packages/special/source.py in the Whitelist...

Pig-Mesh Pig input validation error vulnerability

Versions 4.0 and 4.1.0 of Pig Mesh contain a security vulnerability. This vulnerability stems from improper handling of the “ascs” and “descs” parameters in the orderItem.getColumn function within the file...

SiYuan cross-site scripting vulnerability

Versions 2.9.0 through 3.8.7 of SiYuan contain a cross-site scripting vulnerability. This flaw arises because unauthenticated /check-auth pages assign the to parameter to window.location.href without performing protocol validation, potentially enabling cross-site scripting attacks. Attackers can...

Mansi Khamkar Restaurant_IMS input validation error vulnerability

The Mansi Khamkar RestaurantIMS has a security vulnerability stemming from improper handling of the loginid/epsw parameters in the mysqliconnect function within the file lsmodal.php. This vulnerability can be exploited remotely and may lead to SQL injection...

RuoYi authorization issue vulnerability

Versions RuoYi 2026.09 and earlier contain an authorization issue vulnerability. This vulnerability stems from improper handling of the mobile/code parameter in the AuthController.java file within the SMS Code Verification component, leading to inadequate authentication. It may be exploited...

ProjectSend authorization issue vulnerability

Versions 2.0.0 through 2.7.1 of ProjectSend contain an authorization issue vulnerability. This vulnerability stems from incomplete authorization checks in FileVersions::link. Staff users can share files by linking to unauthorized file versions. Attackers can also link files to intermediate revisi...

YesWiki server request forgery vulnerability

Versions prior to YesWiki 4.7.0 contain a server-side request forgery vulnerability. This vulnerability arises from unauthenticated server-side request forgery, allowing attackers to pass |URL wiki syntax to the render handler. By passing this syntax via the content parameter of the page’s render...

SourceCodester Performance Indicator System input validation error vulnerability

Version 1.0 of the SourceCodester Performance Indicator System contains a security vulnerability stemming from improper handling of the Contact parameter in the file /opils/staff/editdealer.php, which may lead to SQL injection...

ImageMagick resource management error vulnerability

Versions 7.x prior to ImageMagick 6.9.13-58 and prior to 7.1.2-33 contain a resource management error vulnerability. This vulnerability arises because the JNG encoder fails to release allocated memory when processing specially crafted images. Attackers can exploit this by providing a specially...

Tribulant Software Newsletters SQL injection vulnerability

Tribulant Software Newsletters versions 4.18.1 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

phpIPAM cross-site scripting vulnerability

Versions 1.8.3 and earlier of phpIPAM contain a security vulnerability stemming from improper handling of the REQUESTURI parameter in the file upgrade/index.php; this may lead to cross-site scripting attacks...

YunaiV yudao-cloud authorization issue vulnerability

Versions 2026.09 and earlier of YunaiV yudao-cloud contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references within the mall trade module. Authentication members can exploit this by providing any valid afterSaleId value and enumerating subsequent...

Open62541 Digital error vulnerability

In versions prior to 1.5.7 of Open62541, there is a numeric error vulnerability. This vulnerability arises because UADataTypefromStructureDescription experiences an integer overflow when processing large custom structure definitions; it then wraps around the 16-bit memSize field. A malicious OPC ...

WordPress Eventin cross-site scripting vulnerability

WordPress Eventin versions 4.1.26 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation, potentially enabling stored cross-site scripting attacks...

Noah Hearle Cross-site Scripting Vulnerability

Noah Hearle: Versions 2.6 and earlier of “We’re Open” contain a cross-site scripting vulnerability caused by improper input handling during web page generation; this makes them susceptible to reflected XSS attacks...

WordPress Better Messages cross-site scripting vulnerability

WordPress Better Messages versions 3.1.3 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to DOM-based cross-site scripting attacks...

ONE ARMY authorization issue vulnerability

Versions prior to ONE ARMY 2.165.2 contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references; authenticated users can mark notifications from other users as read via POST /api/notifications/:id/read. Attackers can then iterate through consecutive...

Crowcpp Crow resource management error vulnerability

Versions of Crowcpp prior to 1.3.4 contain a resource management error vulnerability. This vulnerability stems from uncontrolled recursion in crow::json::load. Remote unauthenticated attackers can exploit it by sending deeply nested JSON, thereby exhausting the work thread stack and causing the...

CervantesSec Cervantes Cross-site Scripting Vulnerability

Versions 0.3 through 1.3-beta of cervantessec contain a cross-site scripting vulnerability. This vulnerability stems from stored cross-site scripting in the “Notes” field of Checklists, potentially allowing attackers to execute arbitrary code with elevated privileges in another user’s browser...

Intern Science InternAgent software supply chain issue vulnerability

Version 1.5.0 of Intern Science InternAgent contains a vulnerability related to the software supply chain. This vulnerability stems from improper handling of the basemodelnameorpath parameter in the train function within the file tasks/AutoChem/code/experiment.py. It may allow unauthorized...

Grav permission and access control issues vulnerability

Versions of Grav from 2.0.15 through 2.2.13 contain a permission and access control vulnerability stemming from list bypass. Page editors can reroute calls to arbitrary public static methods by using unset-name@ or integer keys. Attackers with page editing privileges can insert custom fields with...