CVE Vulnerability Catalog

Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host.

Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host.

Share 2 Archive Today versionCode 61 has insecure permissions that allow unauthorized attackers to arbitrarily overwrite another user's clipboard content by supplying a crafted URL.

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allow unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

Insecure permissions in Ghost Commander File Manager versionCode 479 allow unauthorized attackers to arbitrarily read and write files inside the commander's private storage.

The Crocoblock JetEngine plugin contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects JetEngine from the initial version through 3.9.0.1.

llama.cpp versions from b2877 before b11935 contain an uncaught exception vulnerability in the ggml-rpc server. An unauthenticated remote attacker can send an oversized message length (e.g., in a SET_TENSOR command), triggering std::length_error and aborting the process. This causes denial of service to all clients.

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows invoking arbitrary pandas functions via model-controlled function names passed to getattr(). Attackers can use prompt injection to call pandas.read_pickle on attacker-controlled paths for code execution or read local files.

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Knowing the victim's address, an attacker can become a co-owner and read messages and verification codes, set forwarding, and delete mail.

The InstaWP Connect plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that can force a logged-in user to perform unwanted actions. The issue affects versions from the initial release through 0.1.4.2.

Python-Markdown versions 3.0 through 3.11.2 contain an algorithmic complexity vulnerability in inline link parsing that allows remote CPU exhaustion via unmatched brackets. A short Markdown payload with repeated [ or ![ characters forces quadratic scans in LinkInlineProcessor.getText() and getLink(), keeping workers busy for minutes.

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module. A user with Clinician-level privileges can read and modify arbitrary database contents via crafted values in the form_icd_codes[] POST parameter at the syndromicsurveillance/index endpoint, enabling exfiltration of bcrypt password hashes and administrative account takeover.

The NEX-Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to and including 9.3.2 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported.

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package.

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to and including 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to and including 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The installer for Yamaha LAN Monitor for Windows may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges.