CVE Vulnerability Catalog

Path Traversal and Missing Authorization in the cloud-storage source of Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters.

The boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in version 1.6.0.

The root-privileged 'wsserver' terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page. The description does not provide further technical details.

A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects only devices configured as a vSolution Matrix main/master station with the file sharing feature enabled.

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected application service.

danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration, which accepts any certificate in the peer chain whose public key matches a root in the bundled certifi store, even when the connection is pinned to a private CA. The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname. This issue affects hackney from 1.24.0 before 4.9.0.

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user with permission to create campaign imports can place arbitrary files, including server-side scripts, in the web root, leading to remote code execution on servers such as the default Apache setup of the official Mautic Docker image.

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could manipulate authentication requests and access APIs without a valid authenticated session. Successful exploitation could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, and access and modify sensitive information.

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, 4.4 all versions, and 4.2 all versions may allow an attacker to execute unauthorized code or commands via crafted HTTP requests.

NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. This may allow an attacker to access files outside the intended directory.

A flaw was found in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the L2TP Authentication component. Manipulating the Username argument causes CRLF injection. The attack can be launched remotely and a public exploit is available.

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of /etc/ipsec.conf within the IPsec Policy Handler component. Manipulating the secproto argument results in CRLF injection. The attack can be launched remotely and the exploit is public.

A security vulnerability was detected in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Dnsmasq component. Manipulating the rent_time argument leads to CRLF injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A weakness was identified in Oray Pugongying X5 Pro 7.6.1 affecting the snmp_set function of the SNMP Handler component. Manipulating the info.community argument can lead to CRLF injection. The attack can be launched remotely and a public exploit is available.

A security flaw was discovered in Oray Pugongying X5 Pro 7.6.1 in an unknown function of the Ser2net component. Manipulating the regmsg argument results in CRLF injection. The attack can be initiated remotely and the exploit has been publicly released.

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. Bodies are also sent for 1xx, 204, and 304 statuses. A client or proxy may read those bytes as the start of the next response.

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string, allowing subquery injection.