CVE Vulnerability Catalog

Turms Server version 0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects, and after successful login, raw passwords are stored unencrypted in memory in the rawPassword field.

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to "image/*" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served.

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted URI. This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the SSH process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

Podatność typu 'Open Redirect' w systemie dostarczania jedzenia online firmy Restajet Information Technologies Inc. umożliwia przekierowanie użytkowników na niezaufane strony, co może prowadzić do phishingu oraz nieautoryzowanego przeglądania.

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload injected into the “Create new Layer” field during layer import is rendered into the DOM without proper sanitization, causing the injected script to execute when the Layers panel is accessed.

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name and is rendered into the DOM without proper sanitization, causing the injected script to execute each time the affected PDF is loaded.

Versions of the fastapi-sso package before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to improper validation of the OAuth state parameter during the authentication callback. The get_login_url method allows state generation but does not persist or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

A weakness has been identified in JeecgBoot up to 3.9.0 in the SysUserOnlineController function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely and the exploit is public. Applying patch b686f9fbd1917edffe5922c6362c817a9361cfbd is advised.

A security flaw has been discovered in JeecgBoot up to 3.9.0. It affects an unknown function in the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysTenantController.java of the Multi-Tenant Management Module. Manipulation of the ID argument results in improper authentication. The attack can be initiated remotely, and the exploit has been publicly released. The patch is named e1c8f00bf2a2e0edddbaa8119afe1dc92d9dc1d2/67795493bdc579e489d3ab12e52a1793c4f8a0ee.

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.

An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining access to the agents' knowledge and the ability to trigger their intents, by manipulating initialization parameters or crafting specific API requests. All versions after August 20th, 2025 have been updated to protect from this vulnerability. No user action is required for this.

A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php.

A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname parameter, potentially leading to information disclosure or database manipulation.

Reflected XSS vulnerability in phpMsAdmin version 2.2 in database_mode.php. An attacker can execute arbitrary web script or HTML via the dbname parameter after authentication.

A vulnerability in Avahi (up to and including 0.9-rc5) allows the simple protocol server to ignore the documented client limit (CLIENTS_MAX) and accept unlimited connections. This enables unprivileged local users to exhaust daemon memory and file descriptors, causing a local denial of service (DoS). No official patched version is available, but a candidate fix exists in pull request 808.

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system.

Dify 1.9.1 and 1.17.0 expose the /console/api/system-features endpoint to unauthenticated HTTP GET requests, returning system feature and configuration information. Per the maintainer, the endpoint is unauthenticated by design as a bootstrap mechanism for dashboard initialization, and the data is non-sensitive with no PII, credentials, or secrets exposed.

FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.

Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Radius Blocks: from n/a through <= 2.2.1.

An authentication bypass vulnerability exists in AnythingLLM v1.8.5 via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces, including identifiers, AI model configurations, system prompts, operational parameters, and vector search settings.