CVE Vulnerability Catalog

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed, cscript.exe raises a 'Type mismatch' error that includes the offending parameter value in plaintext. The %windowspassword variable can be passed as a parameter, leading to password disclosure.

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler before 3.4.3.

In GIMP, when processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

The YOP Poll plugin for WordPress up to version 7.0.10 is vulnerable to Origin Validation Error. The plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This allows unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page.

SQL Injection vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to inject malicious SQL code into queries.

SQL Injection vulnerability in DIAEnergie before version 1.11.00.022. Allows an attacker to inject malicious SQL code into queries.

The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress up to version 1.0.3 is vulnerable to Path Traversal via the `id2wp_path` parameter. This allows unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

A path traversal vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.

The MasterStudy LMS WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release but this one was not, so the issue persists in versions the earlier advisory reports as fixed.

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the plugin itself; if one is present via another installed plugin, this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, caused by an unchecked copy of the Sec-WebSocket-Version header through snprintf.

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype, and in versions 1.11.0 through 1.12.1 it can also disclose local server file contents when externalFileAccess is set to true.

A vulnerability was detected in ShopXO up to 2.2.7 in an unknown functionality of config/ueditor.php in the Ueditor Upload Interface component. Manipulation of the path_type argument results in path traversal. The attack can be launched remotely and the exploit is publicly available.

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret to an empty string, and Config.Validate() does not reject the empty value, so a deployment without a configured secret signs and verifies session tokens with an empty HMAC key. An unauthenticated attacker who knows an existing user's ID can forge a valid session token for that user, including an administrator.

A vulnerability was identified in java110 MicroCommunity up to 2.0 in the QueryServiceSMOImpl.fallBack function of BusinessApi.java in the fallBack API Endpoint component. Manipulation of the fallBackSql argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1 in the UnmountSegment function of the RPC Path Handler component. Manipulation of the client_id/segment_id arguments causes authorization bypass. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability in pmTicket Project-Management-Software up to version 078fa56a782490c5059a0814f84df27984f4d7e2. The setSync function in /ajax/add_project.php improperly handles the conn_settings argument, leading to SQL injection. The attack can be launched remotely.

GitLab EE versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 have a vulnerability that under certain conditions could allow an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. Affects versions before 3.0.1a.