CVE Vulnerability Catalog

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 affecting the load_param_in_txt function in python/src/nnabla/utils/cli/encode_decode_param.py (Encode Param Command Handler component). Manipulation leads to code injection, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond to the disclosure.

A vulnerability was found in QuantGeekDev docker-mcp 0.1.0/0.2.0 affecting the _build_windows_command function in docker_executor.py. Manipulating the project_name argument causes OS command injection, and the attack can be initiated remotely.

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 affecting an unknown function in /deletetransac.php. Manipulating the ID argument results in SQL injection, and the attack can be performed remotely. The exploit has been made public and could be used.

A vulnerability was found in gougucms up to 4.08.18 affecting the Add function in app/admin/controller/Level.php (User Level Handler component). Manipulating the Title argument leads to cross-site scripting, and the attack can be carried out remotely. The exploit has been publicly disclosed and the vendor did not respond to the disclosure.

A vulnerability was found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 affecting the BlitzBanks function of the Skynet++ Virtual Machine component. Manipulation can lead to an out-of-bounds write, and the attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in SteelRaven7 Ravenfield 25407073 affecting the cacheCoverPoints function of the RFL/RFLD Custom Map Handler component. Manipulation results in deserialization, and remote exploitation is possible. A patch named EA39 Security Patch is available.

A security vulnerability was detected in CloudClassroom-PHP-Project affecting an unknown part of addnewstudent.php. Manipulation of the fname argument leads to cross site scripting, and the attack may be launched remotely. The exploit has been publicly disclosed and may be used; the product uses a rolling release model with no version details.

In ggml-org llama.cpp, the function list_pockettts_state_slots in tools/mtmd/models/pockettts-gen.cpp (Pocket-TTS component) allows out-of-bounds write via manipulation of the mmproj argument. The attack requires local access, and the exploit is publicly available. Upgrading to version b11796 resolves the issue.

In smg-project smg versions 1.7.0–1.10.1, the function jpeg_turbo::decode_jpeg_rgb in crates/multimodal/src/jpeg_turbo.rs (llm-multimodal component) leads to uncontrolled memory allocation. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 1.11.0 addresses the issue.

A vulnerability was identified in EyouCMS up to version 1.8.3, affecting the remote_file_to_local function in application/function.php. Input manipulation can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

Incorrect Authorization vulnerability in ash_postgres allows a user to read another tenant's record through a skipped upsert. When a create runs as an upsert with return_skipped_upsert?: true and the upsert is skipped, the data layer reads the existing row by upsert identity without applying attribute multitenancy, potentially exposing another tenant's fields.

Incorrect Authorization vulnerability in ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many or through relationship is loaded with a lateral join, the query for the join resource is built without running its read action, which applies attribute multitenancy, causing rows from other tenants to be joined.

Incorrect Authorization vulnerability in ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship with through: is loaded for a single record with a limit of 1, or an unsorted has_one through relationship with a limit of 1, the read path chosen lacks a filter linking destination to source, returning the first destination record by sort or another record with an offset.

A weakness was identified in DedeCMS up to 5.7.118 in the require_once function of dede/update_guide.php. Manipulating the vtime argument causes code injection. Remote exploitation is possible and the exploit has been made public.

A security flaw was found in SourceCodester Performance Indicator System 1.0 affecting /opils/staff/save_profile.php. Manipulating the Contact argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.

A vulnerability was identified in SourceCodester Performance Indicator System 1.0 affecting /opils/staff/edit_dealer.php. Manipulating the Contact argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was found in SourceCodester Performance Indicator System 1.0 affecting the file /opils/staff/adddealer.php. Manipulating the Contact argument leads to SQL injection. The attack can be launched remotely and a public exploit exists.

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request with a large Content-Length to exhaust server memory. The read buffer grows to the declared length before data arrives, causing an out-of-memory exit. The server runs as a single process, so it stays down until restarted.

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The decoder does not limit chunk-size line length or buffer size. A remote attacker can exhaust worker memory with a single connection.

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. Bodies are also sent for 1xx, 204, and 304 statuses. A client or proxy may read those bytes as the start of the next response.