CVE Vulnerability Catalog

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes malicious content to the same path, bypassing integrity checks.

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to expose protected original files to unauthorized clients.

Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.

Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.

Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the monitoring webhook destination receiving alerts.

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.

A SQL Injection vulnerability was found in the Employee Recruitment System (krupalshah) in /source/registerform3.php. Manipulating the pemail argument allows remote attack, and a public exploit is already available. The product is no longer supported by the maintainer, and the vendor did not respond to the disclosure.

A SQL Injection vulnerability was found in EmployeeRecruitmentSystem (krupalshah) in /source/registerform2.php within the mysql_query function. Manipulating the university/institute/branch/degree/status/cpi/semester/experience arguments enables remote attack, and the exploit has been publicly disclosed. The product is no longer supported, and the vendor did not respond to the disclosure.

A SQL injection vulnerability was detected in krupalshah EmployeeRecruitmentSystem within the mysql_query function of /source/registerform1.php. Manipulation of the firstname, middlename, lastname, gender, birthdate, state, statespecify, city, and cityspecify arguments allows SQL injection. The exploit is publicly available and can be launched remotely.

A cross-site scripting (XSS) vulnerability was found in Privoce Vocechat up to version 0.9.121, in the widget.html file's handling of the 'welcome' query parameter. Manipulation of this argument allows execution of malicious script. The attack can be launched remotely, and the exploit has been publicly disclosed.

A path traversal vulnerability was found in eventcatalog sdk up to version 2.29.0, affecting the getCustomDoc, writeCustomDoc, and rmCustomDoc functions in packages/sdk/src/custom-docs.ts. Manipulation of the options.path argument allows a local attacker to perform path traversal. The issue is fixed in version 2.30.0.

A path traversal vulnerability was detected in 1999AZZAR designer-mcp up to version 2.1.0, affecting the get_reference function in skills/motion-designer/references/motion-dev-guidelines.md within the MCP Interface. Manipulation of the Name argument allows remote exploitation, and the exploit is publicly available. The product uses rolling releases, so version details are unavailable; patch c8c2951dcbed9b1710a745993f028317f10a3f10 is identified.

The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification originated from the payment provider before marking the associated order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without any payment being made.

A vulnerability was detected in prasathmani TinyFileManager up to 2.6 in the remote URL file upload module of tinyfilemanager.php. The manipulation leads to unrestricted upload, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy. This allows unauthenticated attackers to create and authenticate as a WordPress administrator.