CVE Vulnerability Catalog

Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP (mindio-magic-mcp) allows Retrieve Embedded Sensitive Data. This issue affects Mindio Magic MCP from n/a through 0.5.6.

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET /v2/users/{userId}/authentication_methods to learn which authentication method types users in other organizations have registered.

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID to obtain refIDs and refCount of hidden referencing blocks, bypassing the publish confidentiality boundary.

A path traversal vulnerability was detected in RainyGao DocSys up to 2.02.85 in the DocController.doGetTmp function of /Doc/doGetTmpFile.do (Document Controller component). Manipulation of the path/fileName arguments leads to path traversal. Remote exploitation is possible and the exploit is publicly disclosed.

A SQL injection vulnerability was found in Discuz! X5.0 (versions 20260801, 20260820, 20260910) in the modmedalsubmit function in mod.php. Manipulation of the argument delete results in SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability has been found in Weaviate Verba up to 2.1.3 in the get_environment function of goldenverba/components/util.py, part of the generate_stream Endpoint component. The manipulation leads to information disclosure. The attack can be performed remotely and the exploit has been publicly disclosed.

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows in the StaticFileRouter::route function of lib/src/StaticFileRouter.cc, part of the Static File Router component. The manipulation leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed.

A security flaw has been discovered in topoteretes cognee up to 1.5.4 in the get_user_id_by_email function of cognee/modules/users/authentication/get_api_auth_backend.py, part of the JWT Signing Key Handler component. Manipulation of the FASTAPI_USERS_JWT_SECRET argument results in hard-coded credentials. The attack can be launched remotely.

In Laradock up to and including 20.4, the build process (workspace/Dockerfile) downloads code without integrity verification. The attack is remote but of high complexity and difficult exploitability; the exploit has been publicly disclosed. The fix in version 20.5 replaces plaintext downloads with HTTPS-only downloads and verifies SHA-256 hashes.

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations. The rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.

The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values. This allows authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end. This allows users granted access to the announcement management page (Contributor and above) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.

The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout. This allows unauthenticated attackers to modify the shipping information stored on arbitrary orders.

A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support Ticket API. The manipulation of the argument status/page/count results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session token via /api/v1/tokens/refresh.json. Because TokenRefreshHandler never checks token type, attackers can exchange short-lived or IP-restricted API tokens for 30-day normal session tokens that bypass API token expiry and allowlists.

A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/{option_name} to retrieve plaintext AI provider API keys, mail credentials, passwords and tokens.

LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links to logged-in users with email template permissions so saving a template navigates them to attacker-controlled phishing sites.

LaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS lookups and paid AbstractAPI verification calls. Unauthenticated attackers can submit arbitrary addresses to exhaust the verification quota, making validation fail open for all public forms, and probe domain resolution.