CVE Vulnerability Catalog

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval() calls in the vendored PEAR HTML_QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms use hardcoded element names; exploitation requires a developer-specific plugin or misconfiguration that lets user input reach those element names. Where that conditional path exists, the impact can be full server compromise. This issue is fixed in versions 1.11.40 and 2.0.1.

An improper access control vulnerability exists in the MFA functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA settings, enable or disable MFA, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. The issue is fixed in build 4507.

A stored XSS vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and executed in other users' browsers when charts are rendered. The issue is fixed in build 4508.

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler. An authenticated user can attach resources to other users' connections by including a victim's connectionId in a batch request.

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via /api/v1/auth/login to modify library and configuration settings and install JavaScript plugins running in QuickJS.

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. An authenticated attacker can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a session cookie carrying a user_id to gain full administrative access.

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. An attacker can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. An attacker authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. An attacker who knows another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated SQL injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

CoreShop through 1.5.5 contains an unauthenticated SQL injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind techniques to extract member accounts and orders.

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. An attacker can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. An attacker can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. An attacker can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().