CVE Vulnerability Catalog

The vulnerability in MicroRealEstate stems from broken object-level access controls and the use of a deterministic pattern during random ID generation. This allows attackers to access documents uploaded by landlords or tenants without authorization.

MicroRealEstate is vulnerable to broken object-level access controls in its PDF generator functionality. This affects versions through 1.0.0-alpha3.

A vulnerability in MicroRealEstate allows attackers to bypass authentication due to a lack of token state management. This enables brute-forcing One-Time Passwords (OTP) to log in as any user.

The Frontend File Manager Plugin for WordPress up to version 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.

Coolify prior to version 4.0.0-beta.469 has a vulnerability in the executeInDocker() helper that wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement.

Coolify prior to version 4.0.0-beta.474 has a vulnerability in the PostgreSQL initialization script that allows an authenticated user to write files outside the intended directory and achieve command execution through database initialization.

Coolify prior to version 4.0.0-beta.471 has a vulnerability where user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation. This allows an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered.

In Coolify prior to version 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID. An attacker who can cause a victim to visit the crafted invitation URL can reset the victim's account password to a predictable value.

Coolify prior to version 4.0.0-beta.471 contains a shell command injection vulnerability. The LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without proper shell argument escaping, allowing an authenticated user to execute arbitrary commands on managed servers when the resource is deleted.

In Coolify prior to version 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment.

In Coolify prior to version 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without sanitization. This parameter is interpolated into shell commands executed via SSH on managed servers, allowing any authenticated team member to execute arbitrary OS commands on remote servers.

Coolify prior to 4.0.0-beta.471 has a vulnerability in the database import Livewire component that allows an authenticated user to inject commands via the database import container name. Lack of locking and validation lets client-controlled container and server properties reach shell commands.

In Coolify prior to version 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID.

Coolify prior to version 4.0.0-beta.466 has a vulnerability where log drain secrets and environment values are interpolated into shell commands without proper encoding. This allows an authenticated user to inject commands executed on the host.

Coolify prior to version 4.0.0-beta.466 has a vulnerability due to insufficient validation of the sentinel_token setting used in shell commands. An authenticated user with access to server Sentinel settings can inject shell syntax and execute commands on the host when Sentinel is restarted.

In FOSSBilling versions 0.5.6 through 0.7.2, when a client requests a password reset multiple times, the system reuses the existing token instead of generating a new one, with the 15-minute validity anchored to the first request. An attacker who obtained the original reset link can still use it even after the victim requests a new reset, as the original token is never invalidated.

FOSSBilling prior to version 0.8.0 contains a vulnerability that allows a low-privileged staff account to escalate privileges via the admin API. A user with the `staff.create_and_edit_staff` permission can call `/api/admin/staff/permissions_update` for their own account and set any permissions, bypassing role-based access control.

FOSSBilling versions 0.5.3 through 0.7.2 allow authenticated clients to read and reset API key secrets for orders that are no longer active (e.g., suspended, canceled). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper existing in the `Serviceapikey` module and the frontend UI correctly gating access on active orders.

FOSSBilling versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag and insufficient permission checks or unsafe parameter handling on individual endpoints.

FOSSBilling versions 0.6.10 through 0.7.2 contain a PHP code injection vulnerability in the Config::prettyPrintArrayToPHP() method. An attacker with admin privileges can inject arbitrary PHP code into config.php, which is executed on every HTTP request.