CVE Vulnerability Catalog

In Plane prior to 1.4.0, the GET /api/workspaces/{slug}/entity-search/?query_type=user_mention endpoint returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even if not a member. It also exposes ProjectMember rows under the same condition, because SearchEndpoint inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check.

In Plane prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace via PATCH /api/workspaces/{slug}/projects/{project_id}/estimates/{estimate_id}/, and inject comments into an issue from another workspace via POST /api/workspaces/{slug}/projects/{project_id}/issues/{issue_id}/comments/. ProjectEntityPermission verifies membership from the URL, but estimate_id and issue_id are fetched by primary key without confirming the same scope.

The Joomla extension TF Content versions 2.9.0 - 2.9.4 exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token enforcement. A Guest can supply the numeric ID of any published TF Content task and make the component dispatch its configured executor immediately.

adm-zip prior to 0.6.1 applies Unix permission bits from a zip entry directly to the extracted file via fs.chmodSync() when keepOriginalPermission=true is passed to extractAllTo()/extractEntryTo() — and never filters out setuid/setgid/sticky bits. A crafted zip can produce an extracted binary with mode 04755, leading to attacker code execution as root when extraction runs as root.

ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.

In Plane prior to 1.4.0, the aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges.

The mppx-condition-gate and mppx-token-gate packages prior to versions 3.0.0 and 1.0.4 respectively read a wallet address from client-supplied credential.source, check whether that public address met configured on-chain conditions, and return a successful free-access receipt without invoking the payment verifier or proving caller control of the wallet. An unauthenticated attacker could name any qualifying wallet and obtain content that should require payment, and cached grants could be reused for the cache lifetime.

Kunstmaan CMS prior to 7.3.2 performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and then lowercases the stored extension. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types.

In the Joomla extension Phoca Cart versions 5.0.0 - 6.1.8, the order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user, including a guest with no account, can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.

The Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 contains a Server-Side Request Forgery (CWE-918) vulnerability. It may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

In Progress Telerik Fiddler Classic for Windows prior to version 6.0.20262.10021, the integrity check for external helper tools is insufficient. The application only verifies the Authenticode signature and publisher name, not that the file is the specific executable shipped with the product. A local attacker with low privileges can replace a helper executable with another validly signed binary from an allow-listed publisher, causing it to be executed, including with Administrator privileges.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver to be loaded from a remote location, so opening the document could run Java code from that location. In fixed versions an entry in a Java class path has to be a file URL.

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early but did not respond.

A vulnerability has been detected in feelcrm-os 1.0.0 (feelec-yishu project). It affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php in the getCurlData Endpoint component. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in the system-call verifier for i3c_do_ccc() in Zephyr RTOS, which fails to validate per-target data pointers in the i3c_ccc_payload structure. The verifier also operates on the caller's live structure, allowing another thread to modify fields between check and use. This allows an unprivileged thread to write to arbitrary kernel addresses (via read CCC) or disclose kernel memory (via write CCC), leading to privilege escalation.

The NXP GAU ADC driver (adc_mcux_gau_adc.c) incorrectly validates the caller-supplied buffer size: it compares bytes against the number of channels (samples) and then uses that byte count as the number of uint16_t slots. As a result, a buffer accepted as 'large enough' can be written up to twice its size in bytes, causing an out-of-bounds write for every sample past the buffer's midpoint.

A SQL Injection vulnerability was found in itsourcecode Online Admission System Project 1.0 within the file /admin/login1.php, caused by improper handling of the User argument. The flaw can be exploited remotely and a public exploit is already available.

A vulnerability was found in DigitalCanion SA's product within the Configuration → Services → Music on Hold functionality of the web portal on TCP port 443, which fails to properly validate uploaded file types. An authenticated attacker can upload a malicious .so file instead of a WAV file, leading to remote code execution in the context of the affected process.