CVE Vulnerability Catalog

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail.

CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values. Attackers can supply CR/LF sequences in attachment MIME types or Content-IDs passed to Message::setAttachments() or HTTP client multipart data to add arbitrary headers or content.

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.

Płatnik uses the HTTP protocol to download updates, libraries, and support files. This allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data, and replace the original files with their own. The issue was fixed in metric 242 in version 10.02.002.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct reading of broker credentials, making this an indirect extraction method.

A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.

The vulnerability in the Drupal Data field module involves improper neutralization of input during web page generation, allowing Stored XSS. This issue affects versions from 0.0.0 to 2.0.14.

The Drupal Permissions by Term module contains an Improper Check for Unusual or Exceptional Conditions vulnerability that allows forceful browsing. This issue affects Permissions by Term versions from 0.0.0 to 3.1.41.

The Easy Breadcrumb module for Drupal contains a missing authorization vulnerability that allows forceful browsing. This issue affects versions from 0.0.0 to 2.0.11.

The Country module for Drupal contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 2.1.3 and from 2.2.0 to 2.2.1.

The Menu Link Attributes module for Drupal contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 0.0.0 to 1.8.0.

In Eye of GNOME, parsing a crafted PNG image with malformed color profile metadata fails to validate chunk boundaries while searching for a null terminator. This causes the application to read past the allocated buffer.

Ghostscript has improper bounds validation when processing indexed color values in mesh shading data. A remote attacker can entice a user to process a crafted PDF or PostScript document, triggering an out-of-bounds memory read.

MariaDB Connector/J from 3.0.0 until 3.3.7, 3.4.5, and 3.5.11 has MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations that trust the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocate and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This is fixed in versions 3.3.7, 3.4.5, and 3.5.11.

In node-forge before 1.4.1, the bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue.

In node-forge prior to 1.4.1, pki.verifyCertificateChain() modified the CA store while testing certificates sharing a subject name. A failed chain verification could permanently remove trusted CA certificates from the store, causing later valid chains to fail.

In node-forge prior to 1.4.1, PKCS#7 padding validation during CBC and ECB decryption checked only the final padding byte. Zero, oversized, or mismatched padding bytes were accepted, potentially silently removing up to four plaintext blocks.

In node-forge prior to 1.4.1, asn1.oidToDer() did not range-check the first two arcs of an OID. An application accepting an untrusted OID string, checking it, and then encoding it with asn1.oidToDer() could emit DER representing a different, trusted OID.