CVE Vulnerability Catalog

In Open WebUI prior to 0.10.0, the WebSocket terminal URL was built from an unencoded session_id, allowing query injection to impersonate another user. The HTTP proxy also forwarded X-User-Id without integrity checks, enabling identity manipulation.

In Open WebUI before version 0.10.0 with Redis configured, real-time connection authentication (Socket.IO, WebSocket) used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating.

A vulnerability in Open WebUI before version 0.10.0 allows authenticated users to execute Python code or tools in another user's session. An attacker can exploit Socket.IO events to hijack a victim's session after learning their socket ID.

Open WebUI prior to 0.10.0 runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads using pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools.

In gpsd up to release 3.27.5 (fixed in commit 4c06658), a command injection vulnerability exists in the gpsprof tool. An attacker controlling the GPS device subtype value can embed backtick payloads in the gnuplot plot title, leading to arbitrary shell command execution when the victim renders the plot.

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.

A stack-based buffer overflow vulnerability exists in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service by sending a crafted second SETUP request, crashing the RTSP service.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The second-stage URL parser fails to validate the URL length, enabling an attacker to bypass first-stage validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service and making the device inaccessible to all clients on the local network.

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request, which can cause the service to crash.

Tenda CP3 V3.0 firmware V31.1.9.91 fails to validate the Content-Length header in RTSP requests (DESCRIBE, SETUP, PLAY). When a request includes this header without a body, the RTSP parser enters a persistent body-awaiting state, permanently blocking the TCP connection. An unauthenticated remote attacker can exploit this to exhaust TCP resources and cause a denial-of-service condition.

The incremental HTML parser (html.parser.HTMLParser) allows CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the /login.php file. An attacker can remotely manipulate the Username argument, leading to unauthorized database access. The exploit is publicly available.

PayRange Android app version 7.0.7 and below has an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote, unauthenticated attacker can steal information sent by the user.

In n8n, an open source workflow automation platform, prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This allowed unauthenticated requests to be treated as a privileged user and exposed user and project listing endpoints.

Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.

A null pointer dereference vulnerability exists in Zeek before 8.0.9 in its Kerberos protocol analyzer. An unauthenticated remote attacker can crash the sensor by sending a crafted KRB_ERROR message with error code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19.

A vulnerability in the FTP analyzer of Zeek before version 8.0.9 allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. The NVT_Analyzer component lacks a maximum line length check, causing uncontrolled memory consumption during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.

A SQL Injection vulnerability in the AcyMailing extension for Joomla versions below 10.11.1 allows unauthorized database access and data leakage.