CVE Vulnerability Catalog

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise.

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request, leading to request smuggling when used without proper URI sanitization. Versions 4.1.129.Final and 4.2.8.Final fix the issue.

Weblate, a web based localization tool, in versions prior to 5.15 allowed retrieving user notification settings or listing all users via API. Version 5.15 fixes the issue.

Weblate is a web-based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue.

Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database contents, potentially including credentials.

Misskey is an open source, federated social media platform. Attackers using an untrusted reverse proxy or no reverse proxy can bypass IP rate limiting by adding a forged X-Forwarded-For header. Starting with version 2025.9.1, an option (trustProxy) was added to prevent this, but it has an insecure default value before version 2025.12.0-alpha.2, making it still vulnerable if not configured correctly. The fix in v2025.12.0-alpha.2 flips the default value of trustProxy to false.

Weblate prior to version 5.15 does not validate or sanitize the repository URL field in the Create Component functionality, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost and internal network addresses. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL, creating a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. Additionally, error messages enable local file enumeration via file:// requests, and in cloud environments internal-only endpoints such as cloud metadata services may be accessible.

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can export the posts and view the contents. Version 2025.12.0 fixes the issue.

In CTCMS Content Management System up to version 2.1.2, there is a vulnerability in the template management module (CT_Parser.php). Improper neutralization of special elements in the template engine allows remote attacks.

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x, displays the full server stack trace when encountering an error within the GetCdfResource servlet. This may reveal technical details of the environment.

A code injection vulnerability has been discovered in CTCMS Content Management System up to version 2.1.2, affecting an unknown function in the /ctcms/libs/Ct_Config.php library within the Backend System Configuration Module. Manipulating the Cj_Add/Cj_Edit arguments allows remote code execution. The exploit is publicly available.

A code injection vulnerability has been identified in CTCMS Content Management System up to version 2.1.2, affecting the Save function in the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. Manipulating the CT_App_Paytype argument allows remote code execution. The exploit is publicly available.

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1: a hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet. Because these credentials are embedded directly, any unauthorized party could retrieve them and misuse the Flickr integration. An attacker with access could impersonate the legitimate application and initiate valid Flickr OAuth flows; if a user approves such a request, the attacker could gain access to the user's Flickr data. The hardcoded credentials have been removed and the key revoked.

IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1 through 8.1.2.3 is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated, potentially enabling unauthorized access under certain network conditions.

IBM UCD - IBM DevOps Deploy versions 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved LLM API Token.

IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

An integer overflow exists in the Bluetooth Host stack within the bt_br_acl_recv routine, a critical path for processing inbound BR/EDR L2CAP traffic. The flaw affects a critical data processing path.

The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4 registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses Intent.EXTRA_CHOSEN_COMPONENT without checking for null, so a broadcast with extras but without EXTRA_CHOSEN_COMPONENT causes a NullPointerException. Because the receiver is exported and performs no permission or caller validation, any local application can send crafted ACTION_SEND broadcasts to repeatedly crash the host application.

An HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTML via the text parameter of add_project_comment function.

An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Terms and Conditions document can inject arbitrary Jinja expressions into the terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.