Cross-site Scripting (XSS)

Astro is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping of user-controlled values in transition:persist, transition:scope, and transition:persist-props directives, which allows an attacker to inject arbitrary HTML or JavaScript into the server-rendered...

CSV Injection

Snipe-IT is vulnerable to CSV Injection. The vulnerability is due to insufficient sanitization of the User-Agent header before exporting activity logs to CSV, allowing authenticated users to inject spreadsheet formulas that may execute when the exported report is opened in spreadsheet software...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when updating maintenance records, where a user can change the assetid without validation against the new asset, allowing maintenance records to be reassigned to assets outside the user's...

Path Traversal

Snipe-IT is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of asset image paths during CSV import and image deletion, where attacker-controlled path traversal sequences can reference arbitrary files, allowing authenticated users to delete files accessible to the...

Information Disclosure

phpMyFAQ is vulnerable to Information Disclosure. The vulnerability is due to inconsistent access control on public FAQ API endpoints, where inactive or unpublished FAQ entries are returned without proper status validation, allowing unauthenticated attackers to access non-public FAQ content...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to improper handling of missing permission fields during user updates, where existing permissions can be unintentionally overwritten with a sparse permission set, allowing authorized users to remove administrative or...

Path Traversal

phpMyFAQ is vulnerable to Path Traversal. The vulnerability is due to improper path validation during PDF generation, where attacker-controlled image paths are passed to filegetcontents without canonicalization or directory containment checks, allowing authenticated users to read files outside th...

Arbitrary File Upload

TYPO3 CMS is vulnerable to Arbitrary File Upload. The vulnerability is due to missing server-side enforcement of configured MIME type restrictions, where uploaded files are not validated against allowed MIME types, allowing attackers to upload files with arbitrary MIME types...

Allocation Of Resources Without Limits

websocket-driver is vulnerable to Allocation Of Resources Without Limits. The vulnerability is due to parsing arbitrarily long WebSocket frame length headers into unbounded arbitrary-precision integers, which allows an attacker to consume excessive memory and cause the host process to run out of...

Denial Of Service (DoS)

websocket-driver is vulnerable to Denial Of Service DoS. The vulnerability is due to the lack of limits on processing HTTP request or response headers during the WebSocket handshake, which allows an attacker to send an endless list of headers and exhaust the receiving process's memory, resulting ...

Denial Of Service (DoS)

websocket-driver is vulnerable to Denial Of Service DoS. The vulnerability is due to validating only the compressed message size instead of the decompressed size when using the permessage-deflate extension, which allows an attacker to send compressed messages that expand beyond the configured...

Missing Authorization

Kimai is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks on referenced users and activities during Team-related assignment operations, which allows an authenticated Teamlead to add unauthorized users or activities to a team beyond their intended...

Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to missing SafeUrl validation on the Subsonic-compatible podcast creation endpoint, which allows an authenticated attacker to make the server fetch arbitrary private URLs during podcast parsing...

Improper Authorization

Kimai is vulnerable to Improper Authorization. The vulnerability is due to an authorization bypass in the timesheet project assignment logic, where a user-supplied project ID can bypass access restrictions, which allows an authenticated attacker to reassign timesheets to unauthorized projects and...

Authentication Bypass

Kimai is vulnerable to Authentication Bypass. The vulnerability is due to the REST API accepting the KIMAISESSION cookie as authenticated before TOTP verification is completed, which allows an attacker with a valid account password to bypass two-factor authentication and access protected API...

Remote Code Execution (RCE)

MantisBT is vulnerable to Remote Code Execution RCE. The vulnerability is due to the use of eval when processing non-string configuration values in the Manage Configuration feature, which allows an administrator to inject malicious class definitions that execute arbitrary code through PHP's...

Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of IPv6 transition addresses in the outbound URL guard, which allows an attacker to bypass SSRF protections and access internal services or cloud metadata endpoints through a malicious RSS feed...

Cross-site Request Forgery (CSRF)

Kimai is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to state-changing team creation and object-binding operations being exposed through GET routes without CSRF protection, which allows an attacker to trick an authenticated user into making unauthorized changes to team...

SQL Injection

MantisBT is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the historyorder configuration value in the SQL ORDER BY clause, which allows an attacker with administrative privileges to inject arbitrary SQL statements that execute when users view bug history...

Improper Authorization

MantisBT is vulnerable to Improper Authorization. The vulnerability is due to insufficient permission enforcement in the REST and SOAP APIs, which allows a low-privileged user to change an issue's status despite higher configured status-change restrictions...

Use Of Hard-coded Cryptographic Key

Kimai is vulnerable to Use of Hard-coded Cryptographic Key. The vulnerability is due to the official Docker image using a publicly known default APPSECRET that is neither overridden nor validated, which allows an unauthenticated attacker to forge HMAC-signed cookies and login links to compromise...

Cross-site Scripting (XSS)

MantisBT is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to missing output encoding of image attachment filenames in the alt attribute of an HTML IMG tag, which allows an authenticated attacker to inject and execute arbitrary JavaScript when a user views the HTML export page...

Authentication Bypass

Froxlor is vulnerable to Authentication Bypass. The vulnerability is due to the two-factor validation endpoint issuing a full authenticated session without verifying the user's password, CSRF token, or rate limits, which allows an attacker to brute-force valid TOTP codes and obtain an authenticat...

Authentication Bypass

MantisBT is vulnerable to Authentication Bypass. The vulnerability is due to improper authentication in the SOAP API's mcichecklogin function, which allows an attacker to impersonate any user by supplying a valid cookiestring together with the target user's username without knowing the target's...

Path Traversal

nukeviet/nukeviet is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the attach parameter in the administrator Edit Comment function, which allows an authenticated administrator to traverse directories and delete arbitrary files within the application root...

Improper Authorization

Kimai is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks during the timesheet restart and duplicate workflows, which allows an authenticated user to create new timesheets for projects and activities they are no longer authorized to access...

Command Injection

Pheditor is vulnerable to Command Injection. The vulnerability is due to insufficient validation of terminal commands before passing them to shellexec, which allows an authenticated attacker to bypass the command whitelist using shell command substitution and execute arbitrary commands on the...

Cross-site Scripting (XSS)

MantisBT is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper output encoding of user-supplied parameters in /admin/install.php, which allows an attacker to inject malicious HTML that can be used for credential phishing or open redirect attacks...

Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to missing SSRF protections on the Subsonic-compatible radio endpoints, which allows an authenticated attacker to make the server fetch arbitrary private URLs and return the response content...

Improper Authorization

MantisBT is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation of the user-supplied notetype parameter in the mcissueupdate SOAP endpoint, which allows an attacker to create unauthorized TIMETRACKING or REMINDER notes and, in some cases, inject arbitrary tim...

Authorization Bypass

Kimai is vulnerable to Authorization Bypass. The vulnerability is due to insufficient team-lead authorization checks in the timesheet list API when filtering by user ID, which allows an attacker with viewothertimesheet permission to enumerate other users' timesheet records and disclose sensitive...

Server-Side Request Forgery (SSRF)

Froxlor is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the X-Forwarded-Host and X-Forwarded-Proto headers when constructing URLs for cURL requests, which allows an unauthenticated attacker to spoof these headers and force the server to issue...

Improper Authorization

MantisBT is vulnerable to Improper Authorization. The vulnerability is due to insufficient enforcement of the reportissuesforunreleasedversionsthreshold permission, which allows a user below the required privilege level to assign unreleased product versions...

Improper Authorization

Kimai is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks when creating activities under a specified project, which allows an authenticated user with generic activity-creation permission to create an activity under an unauthorized project by...

Improper Authorization

Kimai is vulnerable to Improper Authorization. The vulnerability is due to missing parent-child consistency validation and insufficient authorization checks during rate editing operations, which allows an authenticated attacker to modify unauthorized project, customer, or activity rate records by...

Authentication Bypass

netlicensing-mcp is vulnerable to Authentication Bypass. The vulnerability is due to the API key middleware failing to enforce authentication and falling back to the server operator's API key, which allows an unauthenticated attacker to invoke privileged MCP operations under the operator's identi...

Improper Origin Validation

MCP Python SDK is vulnerable to Improper Origin Validation. The vulnerability is due to the WebSocket transport accepting handshake requests without validating the Host or Origin headers, which allows an attacker to establish unauthorized cross-origin WebSocket connections...

Sensitive Information Disclosure

cyberdrop-dl-patched is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper host validation that matches supported domains using substring checks, which allows an attacker to use a malicious lookalike domain and capture the user's API key through the Authorization...

Buffer Overflow

PocketSphinx is vulnerable to Buffer Overflow. The vulnerability is due to insufficient boundary checks while parsing language model headers and the use of unbounded sscanf string fields when loading acoustic models, which allows an attacker to supply malicious model files that trigger stack or...

Cross-site Scripting (XSS)

plone.app.textfield is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to returning unsanitized RichText content when the stored and output MIME types are identical, which allows an attacker to inject and execute arbitrary JavaScript in a victim's browser...

Server-Side Request Forgery (SSRF)

com.arcadedb:arcadedb-engine is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the IMPORT DATABASE statement accepting unvalidated source URLs without requiring administrative privileges, which allows an authenticated attacker to issue requests to arbitrary internal o...

Improper Certificate Validation

kuma-dp is vulnerable to Improper Certificate Validation. The vulnerability is due to TLS peer verification being disabled when no CA certificate is provided for an HTTPS control plane, which allows an attacker to perform a man-in-the-middle attack and intercept the dataplane authentication token...

Path Traversal

Nuclio Dashboard is vulnerable to Path Traversal. The vulnerability is due to improper validation of the spec.handler module path before writing function source code to disk, which allows an unauthenticated attacker to perform directory traversal and write arbitrary files to locations accessible ...

Server-Side Request Forgery (SSRF)

github.com/doyensec/safeurl is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to an incomplete private network blocklist that omits newly assigned IPv6 CIDR ranges, which allows an attacker to access resources hosted within those unblocked internal address ranges...

Server-Side Request Forgery (SSRF)

ToolHive is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the authentication discovery process issuing outbound HTTP requests to attacker-controlled URLs without validating private IPs, loopback addresses, or redirects, which allows a malicious remote MCP server to...

Improper Certificate Validation

kumactl is vulnerable to Improper Certificate Validation. The vulnerability is due to TLS certificate verification being disabled when an HTTPS control plane profile is configured without a CA certificate, which allows an attacker to perform a man-in-the-middle attack and intercept API tokens...

Missing Authorization

Woodpecker is vulnerable to Missing Authorization. The vulnerability is due to accepting user-controlled backendoptions.kubernetes.serviceAccountName values without authorization checks, which allows an attacker with push access to run pipeline pods under arbitrary Kubernetes ServiceAccounts and...

Uncontrolled Resource Consumption

github.com/zalando/skipper is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to reading the entire admission webhook request body without enforcing a size limit, which allows an attacker to send excessively large payloads and exhaust memory, resulting in a...

Sensitive Information Disclosure

routesrv is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the lack of authentication on HTTP endpoints exposing routing and cache topology data, which allows an attacker with network access to retrieve sensitive cluster-wide configuration and infrastructure informati...

Code Injection

Nuclio is vulnerable to Code Injection. The vulnerability is due to unsanitized runtimeAttributes.repositories values being injected into the generated build.gradle file, which allows an attacker to inject and execute arbitrary Groovy code during the Gradle build process, resulting in remote code...