CVE Vulnerability Catalog

The Helix3 plugin for Joomla! exposes an AJAX handler task that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files, and update template parameters.

Claude Code versions 2.1.59 through 2.1.128 write responses from the /copy command to /tmp/claude/response.md without UID isolation, randomness, or symlink protection. The file is created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which may contain secrets or credentials.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /patientchangepassword.php file. By manipulating the newpassword argument, an attacker can remotely execute unauthorized database queries. The exploit has been made public, increasing the risk of attacks.

A SQL injection vulnerability has been discovered in itsourcecode Hospital Management System 1.0 in the /patientdetail.php file. An attacker can remotely manipulate the editid argument, leading to SQL injection. The exploit has been publicly released.

A vulnerability was found in LLVM up to version 22.1.6 in the GCRelocateInst::getBasePtr function within IntrinsicInst.cpp, which handles Bitcode files. Manipulation of input data can cause a heap-based buffer overflow. The attack requires local access, and the exploit has been publicly disclosed, although LLVM authors question whether this is a genuine security vulnerability.

A stack-based buffer overflow vulnerability exists in the LLVM library in the llvm::StringMap::insert function within ValueSymbolTable.cpp. The issue affects versions up to 22.1.6 and requires local access to exploit.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /insertbillingrecord.php. An attacker can remotely manipulate the patientid argument, leading to SQL injection. The exploit has been publicly disclosed.

A vulnerability has been found in SourceCodester Simple Food Ordering System 1.0 in the file /cart.php. Manipulation of the item_price argument can lead to business logic errors. The attack can be performed remotely and the exploit has been published.

A vulnerability in HCL DevOps Deploy / HCL Launch allows exposure of sensitive information in output logs. An attacker with access to the logs could potentially obtain sensitive values related to that step.

A vulnerability in the getfattr and setfattr utilities before version 2.6.0 allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files, leading to local privilege escalation when these tools are invoked by a privileged process over an attacker-controlled path.

A TOCTOU race condition vulnerability was found in the ACL library before version 2.4.0, allowing local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.

A symlink traversal vulnerability was found in the libacl library before version 2.4.0 in pathname-based functions. A local attacker can replace any pathname component with a symbolic link, leading to privilege escalation by manipulating access control lists.

FrontAccounting before version 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler. Authenticated attackers with SA_GLANALYTIC permission can inject malicious code into PARAM_2 and PARAM_3 POST parameters to execute arbitrary SQL queries.

FrontAccounting before version 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler. An authenticated attacker can inject UNION SELECT payloads into the PARAM_0 POST parameter, extracting arbitrary database data including usernames, password hashes, and email addresses, which are then rendered into PDF report output.

A path traversal vulnerability in FrontAccounting before version 2.4.20 allows authenticated attackers to achieve remote code execution by uploading files with traversal sequences in the unique_name parameter. Attackers can write a PHP file outside the attachments directory into the web root, leading to arbitrary code execution.

The vulnerability in fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fails to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The normalize() and equal() functions return values that differ from a WHATWG-compatible URL parser, allowing bypass of host-based security policies.

A cross-site scripting vulnerability was found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php. Manipulating the full_name argument in the user registration endpoint allows remote script execution. The exploit is publicly available.

A SQL injection vulnerability has been detected in EyouCMS up to version 1.7.1 in the /index.php file of the API component. An attacker can remotely manipulate the click_like argument, leading to SQL injection. The exploit has been publicly disclosed and may be used.

A vulnerability has been found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php of the User Registration Endpoint. Manipulation of the role argument leads to improper access controls, allowing remote exploitation.