CVE Vulnerability Catalog

Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route. Unauthenticated attackers can execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter, which is passed unescaped into a shell_exec() call.

Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes files via file_put_contents without path confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec, achieving code execution in the user panel context.

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex). A missing exit() call after a header('Location: ...') redirect allows unauthenticated attackers to continue PHP execution past the redirect and reach user panel functionality that should require authentication.

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php. An unsanitized module name parameter is concatenated directly into an include path, allowing local file inclusion and execution of arbitrary PHP code in the user panel context.

Chainlit 2.12.0 contains a server-side request forgery vulnerability that lets unauthenticated attackers bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant.

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script via a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id that executes in administrators' browsers.

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retain parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save blocks containing script or event-handler markup that executes in administrator or Superadmin sessions.

LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download, restore and upgrade actions.

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs.

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks.

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK with empty k, attackers can forge tokens with arbitrary claims.

Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. A crafted .y4m file lacking a terminating newline causes unchecked EOF reads that hang the process while consuming a full CPU core.

libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. A crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits can crash the decoder or leak adjacent memory into decoded samples.

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data stall the stream position and corrupt heap memory.

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Consecutive anchors or tags overflow the fixed two-element annotation array in release builds, corrupting stack memory.

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. A huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute causes allocation failure and a write through NULL.

The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs attr_size of 1 to 15 to read past the allocation and crash analysis tools like istat or icat.

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress(). Malicious USB cameras can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init(). Malicious USB devices can supply an unbounded allocation table entry count to overwrite the saved return address and heap data, potentially achieving code execution.