CVE Vulnerability Catalog

In dataCycle-CORE before version 25.07.3, the documentation and static Markdown renderer improperly handles attacker-controlled path segments. An unauthenticated attacker can use directory traversal sequences to read arbitrary .md files outside the intended docs or static directories.

Vulnerability in dataCycle-CORE before version 26.06.08 (including 25.07.3). The /remote_render endpoint does not restrict which partials can be rendered, allowing a low-privileged authenticated user to access server-side rendered admin content.

Vulnerability in HeyForm before version 3.0.0-rc.9: the POST /api/upload endpoint lacks authentication and form-context validation. Any anonymous user can upload a file (up to 10 MB) and receive a public URL.

The Caddy Defender plugin before version 0.10.1 used `r.RemoteAddr` instead of the resolved client IP (`client_ip`) for request blocking. In deployments behind a trusted proxy, CDN, or load balancer, `RemoteAddr` points to the proxy's address, allowing attackers from blocked IP ranges to bypass the blocking rules.

Mailpit before version 1.30.0 does not limit the size of data sent via SMTP or HTTP, allowing an attacker to send very large messages. This causes a spike in RAM consumption (up to 7-10x amplification), potentially leading to an OOM kill.

Vulnerability in dataCycle-CORE before version 26.06.08 (including 25.07.3). Anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access.

In Wazuh prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow an authenticated cluster peer or attacker with the cluster key to deserialize a malicious callable and execute it under an attacker-controlled RBAC context, leading to full manager compromise.

A vulnerability in EGroupware allows an authenticated attacker to achieve Remote Code Execution (RCE) on the server. If self-registration is enabled, it may be exploitable without authentication. The issue stems from improper authorization checks combined with file write and arbitrary file read primitives.

The HDF5 library is vulnerable to an out-of-bounds read when a file is maliciously crafted – the array datatype size, element count, and element size are inconsistent. The vulnerability only occurs in deliberately altered files, not in normal usage.

Vulnerability in the Parsec file-sharing application: lack of workspace name sanitization allows using a UNC path. If the name is a UNC path, the application may become unresponsive or leak the NTLM hash.

A privilege escalation vulnerability in HCL Commerce could allow denial of service, disclosure of user personal data, and unauthorized administrative operations.

ProFTPD before versions 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.

An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.

FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.

Directory Traversal vulnerability in Menyoo 2.0 before commit 729aa48. A local attacker can execute arbitrary code via Spooner file management, VehicleSpawner, WeaponOptions, and PedComponentChanger functionalities.

Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.

In CI4MS (versions before 0.31.9.0), the Pages module does not sanitize page content before saving to the database, and the view renders it without escaping, leading to stored XSS. The attack affects every visitor, including administrators.

A SQL injection vulnerability has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. The flaw exists in the file /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa, where the Structure_ID parameter is vulnerable to SQL injection. The attack can be performed remotely and the exploit has been made public.

A vulnerability was found in Tenda AC10 version 16.03.10.09_multi_TDE01 in the fromAdvSetLanip function of the /goform/AdvSetLanip file. Manipulation of the GetValue/SetValue arguments leads to a stack-based buffer overflow, which can be exploited remotely.

Vulnerability in QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. The attack can lead to ownership of arbitrary root-owned files or directories, resulting in root access.