CVE Vulnerability Catalog

A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only protections and modify system files and binaries for the duration of a boot session via a bind-mount attack.

The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attackers to recover and obtain sensitive user data.

An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.

GNCC GP5 v7.1.76 stores sensitive wireless network information in plaintext during routine operations to the serial console, allowing physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface.

A vulnerability in MISP dashboard widgets allowed an authenticated user to manipulate the 'fields' option and influence which fields were returned by the 'New Users' and 'New Organisations' widgets. Requesting an empty field set could cause the query to return unintended model fields, including user email addresses even when disclosure was disabled.

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks.

A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument ef_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

FOSSBilling prior to version 0.8.0 does not apply rate limiting to the password reset confirmation endpoint `/client/reset-password-confirm/:hash` because the rate limiter only applies to `/api/*` routes. This allows an attacker to probe the endpoint for valid reset tokens without any per-IP request limiting, attempt counting, or lockout mechanism. The endpoint acts as an oracle, returning a distinguishable response for valid versus invalid tokens (HTTP 200 vs HTTP 302 redirect). However, practical exploitability is significantly mitigated by the current token generation, which uses `hash('sha256', random_bytes(32))`, providing 256 bits of entropy. Tokens also expire after 15 minutes and are deleted after successful use. The same architectural gap applies to other controller-served auth routes, including `/staff/email/:hash` and `/client/confirm-email/:hash`. Version 0.8.0 fixes the issue.

Tautulli before version 2.17.1 has a path traversal vulnerability in the cache deletion endpoint. An authenticated attacker can delete directories outside the configured cache path, leading to data loss and service disruption. Fixed in version 2.17.1.

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.

A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. An attacker could configure a dashboard button that appears to point inside the application but redirects users to an attacker-controlled site.

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. An authenticated user could forcibly overwrite an event template owned by another organization.

A visibility control issue in the event template creation workflow in MISP allowed non-site-admin users to access private galaxies belonging to other organizations. The event template builder loaded all enabled galaxies without applying organization or distribution-based access restrictions.

In itsourcecode Fees Management System up to version 1.0, an XSS vulnerability exists in /navbar.php via manipulation of the page argument. The attack can be performed remotely, and exploit is publicly available.

A SQL Injection vulnerability was discovered in itsourcecode Fees Management System 1.0 in the /manage_user.php file. An attacker can remotely manipulate the ID argument to inject SQL code. The exploit is publicly available.

A SQL Injection vulnerability was found in itsourcecode Fees Management System 1.0 in the /manage_student.php file. Manipulation of the ID argument allows remote SQL injection. The exploit is publicly available.

A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Manipulating the pr_profile_image argument leads to unrestricted file upload. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/updates/add_post.php. Manipulating the up_file_to_post argument results in unrestricted file upload. The attack can be initiated remotely and the exploit has been made public.

WordPress Popup Builder plugin version 3.49 contains a persistent XSS vulnerability that allows authenticated attackers to inject malicious scripts by breaking out of option tags in the post_title parameter. Scripts execute when popups are displayed.

WordPress Soliloquy Lite plugin version 2.5.6 contains a persistent XSS vulnerability that allows authenticated attackers to inject malicious scripts by inserting script tags in the post title field. Scripts execute when the post is previewed.