CVE Vulnerability Catalog

An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's calendar. Zimbra accepts iCalendar CANCEL and REQUEST components without verifying that the email sender is authorized to act as the supplied organizer. An attacker who knows the meeting UID and organizer address can supply a non-outdated sequence number to move the recipient's meeting to Trash or replace its details. Processing occurs automatically during email delivery without recipient interaction.

Entire CLI before version 0.7.7 contains a path traversal vulnerability. Malicious checkpoint metadata fetched from the remote branch can cause transcript data to be written outside the expected session directory, overwriting arbitrary files on the victim's machine.

NetBox MCP Server before version 1.2.1, when running with TRANSPORT=http, has no authentication on the HTTP endpoint. Any client that can reach the port obtains a valid MCP session and full access to all NetBox tools without a token.

In the GTM Server Side plugin by stape.io for WordPress, versions 2.0.0 through 2.1.47, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger rendering of another customer's full order data, including personally identifiable information (PII), into the page's JavaScript dataLayer. This was patched in version 2.1.48.

In odhcpd versions 25.12 and prior, DHCPv6 self-loop detection uses a network-byte-order DUID length value as the memcmp() size parameter. On little-endian hosts, a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer.

In odhcpd (the DHCPv6/DHCPv4/RA server used by OpenWrt) prior to version 25.12, the DHCPv6 IA response handler writes past a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable over the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt, and embedded targets often lack stack canaries and ASLR, making code execution realistic.

In odhcpd (OpenWrt) versions 17.01.0 through 25.12.2, the DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that structure, and reads ia->iaid before proving the IAID field exists. A short IA option at the end of the 8192-byte receive buffer causes an out-of-bounds read, and the disclosed bytes are reflected in the DHCPv6 reply IAID; this can leak the stack canary and ASLR-useful stack contents.

In odhcpd (OpenWrt) prior to version 25.12, the DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options reuse the same Reconfigure authentication key. A DHCPv6 REQUEST can make the first IA set `first`, then a later same-IAID IA fail the on-link check and free that lease, leaving `first` dangling; a following IA copies `first->key`, producing a 16-byte heap use-after-free read. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion.

A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments; an attacker can set a zimbra-controlled daemon_directory and invoke postfix set-permissions to execute their program as root. The Postfix configuration directory is also writable by zimbra.

A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo interface accepts inadequately restricted JVM arguments; an attacker can postpone Jetty's privilege drop, register an OnOutOfMemoryError command, and force heap exhaustion during startup, causing the command to execute while the JVM still runs as root.

A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session.

Zimbra Collaboration Suite (ZCS) contains a mailbox quota-accounting vulnerability. An authenticated user can repeatedly share and revoke a document to permanently consume another user's mailbox quota.

An SMTP command injection vulnerability exists in the data-source testing functionality of Zimbra Collaboration Suite (ZCS). An authenticated user can inject CR/LF into the emailAddress in an SMTP envelope command, and after a successful POP3 or IMAP login Zimbra sends the injected commands to the SMTP service.

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability. Attackers can break out of HTML script elements by ending serialized function source text with an unescaped </script.

In baserCMS, PermissionGroupsService::build() reads a plugin's config/permission.php to determine user group permissions. When that file is absent, it writes a wildcard allow rule for every non-admin group. BcCustomContent has no such file in any release, so after an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root.

In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public mail message API endpoint does not enforce the form's auth_captcha setting. An unauthenticated attacker can automate submissions without solving the captcha.

In baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field, causing a single auto-reply to be addressed to multiple third parties.

In baserCMS, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering.

In baserCMS, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests.

In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin. This can disclose application source and database credentials in config/install.php.