CVE Vulnerability Catalog

Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.

SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].

In Atlona AT-OME-MS42 Matrix Switcher 1.1.2, /cgi-bin/time.cgi allows remote authenticated users to execute arbitrary commands as root via a POST request carrying a serverName parameter.

In libslic3r/GCode/PostProcessor.cpp in PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported. The flaw results from unsafe processing of project files.

A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. The vulnerability may allow an attacker to inject malicious script.

A Cross-Site Scripting (XSS) vulnerability exists in Alkacon OpenCms before 10.5.1 via cmis-online/type.

Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field.

wlc, a Weblate command-line client using the Weblate REST API, prior to version 2.0.0 embeds API response data into HTML without escaping. This allows cross-site scripting when the output is rendered in a browser.

In Nuclei versions 3.0.0 to before 3.8.0, a vulnerability in the JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through the require() function, bypassing the default local file access restriction.

Nuclei is a vulnerability scanner built on a YAML-based DSL. From version 3.0.0 to before 3.8.0, a vulnerability in the expression evaluation engine allows a malicious target server to inject and execute supported DSL expressions. This occurs when HTTP response data containing helper/function syntax is reused by multi-step templates. If the -env-vars / -ev option is explicitly enabled, host environment variables may be exposed; the option is off by default.

An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) via a read size that exceeds the buffer size.

A vulnerability was detected in Simple Chat System 1.0 in sendMessage.php. Manipulation of the type/length/business arguments leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.

A cross-site scripting vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/index.php. Manipulation of the page argument allows injection of malicious script. The attack can be launched remotely and a public exploit is already available.

In huangjunsen0406 xiaozhi-mcphub up to 1.0.3, the code in src/controllers/dxtController.ts is vulnerable to path traversal via manipulation of the manifest.name argument. The exploit is publicly available and could be used for attacks remotely.

A security flaw was discovered in gyoridavid short-video-maker up to 1.3.4 affecting the REST API component (src/server/routers/rest.ts). Manipulation of the req.params.tmpFile argument results in path traversal, and the attack can be launched remotely. The exploit has been released publicly and the project has not responded.

A vulnerability was found in 8421bit MiniClaw up to commit 43905b934cf76489ab28e4d17da28ee97970f91f. The isPathInside function in src/kernel.ts of the executeSkillScript component allows manipulation leading to path traversal. The attack can be launched remotely and the exploit has been publicly disclosed.

Wykryto podatność w 8421bit MiniClaw, dotycząca funkcji executeCognitivePulse w pliku src/kernel.ts. Manipulacja tą funkcją prowadzi do zdalnego wstrzyknięcia poleceń systemowych.

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials.

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication restriction, allowing account creation and session establishment without identity provider validation. The created account was limited to the default base permissions configured on the instance.