CVE Vulnerability Catalog

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content; this requires a page containing the shop's order plugin. Orders that are already paid are not affected.

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0 in an unknown function of the file src/index.ts of the Advanced Search Tool component. Manipulation of the fileType argument results in OS command injection; the attack requires a local approach. The exploit has been released publicly and the real existence of this vulnerability is still doubted.

The download link for files uploaded through a form relied on a predictable token, and the file name in the request was not verified in a guess-resistant way. An unauthenticated attacker could access files uploaded by other visitors; the token was also shown in plain text in the text version of the notification email.

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check protecting the other methods, so the fetched URL is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts and receives the status code and selected response headers, enabling probing of internal hosts and ports; response bodies are not disclosed.

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders still awaiting payment to "canceled"; this requires a page containing the shop's order plugin. Orders that are already paid are not affected.

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

The extension no longer applied its access protection to files in file storages using a non-default relative base path. These files were served directly by the web server without authentication or permission checks. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default.

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS. This issue affects Brizy: 2.8.23.

A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.

An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.

A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.

Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematically identify valid usernames by examining variations in the application's responses, such as changes in response time, discrepancies between error messages or differences in HTTP status codes.

A Stored Cross-Site Scripting (XSS) vulnerability exists in FacturaScripts version 2025.61 due to insufficient validation or sanitisation of user input in the 'city' and 'province' fields in the 'ListAlmacen' endpoint. Successful exploitation could allow an attacker to execute arbitrary JavaScript in the victim's browser or escalate privileges from a normal user to an administrator.