CVE Vulnerability Catalog

Snews CMS 1.7 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files including PHP executables to the snews_files directory. Attackers can upload malicious PHP files through the multipart form-data upload endpoint and execute them by accessing the uploaded file path to achieve remote code execution.

PraisonAI prior to version 4.5.97 has a vulnerability in OAuthManager.validate_token() that returns True for any token not found in its internal store (empty by default). Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities.

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets.

PraisonAI prior to version 1.5.90 has a vulnerability in execute_code() that allows bypassing a three-layer sandbox by passing a str subclass with an overridden startswith() method, leading to arbitrary OS command execution.

PraisonAI versions 4.5.15 through 4.5.69 contain a vulnerability allowing arbitrary OS command execution via the --mcp CLI argument, which is passed without validation to shlex.split() and anyio.open_process(). An attacker can exploit this to execute arbitrary commands in the process user context.

PraisonAI is a multi-agent system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs from the database. An attacker stores a malicious thread ID via update_thread, and when the thread list is loaded, the injected SQL executes, granting full database access.

Kestra prior to version 1.3.7 contains a SQL injection vulnerability in the GET /api/v1/main/flows/search endpoint, allowing an authenticated attacker to achieve remote code execution via PostgreSQL COPY ... TO PROGRAM.

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments. Traffic from VPN connections can bypass configured firewall rules. Attackers can exploit this by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while using an IPv6 Internet connection to circumvent firewall policy enforcement.

Hirschmann HiOS and HiSecOS products contain an authentication bypass vulnerability in the HTTP(S) management module. Unauthenticated remote attackers can gain administrative access by crafting specially formed HTTP requests.

ProSoft Technology ICX35-HWC cellular gateways version 1.3 and prior contain an input validation vulnerability in the web interface, allowing remote attackers to inject and execute system commands with root privileges.

ProSoft Technology ICX35-HWC cellular gateways version 1.3 and prior contain an authentication bypass vulnerability in the web interface. Unauthenticated attackers can gain administrative access without valid credentials.

GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability. Unauthenticated attackers can gain unauthorized access by exploiting a hardcoded string in the authentication mechanism.

Piwigo, an open source photo gallery application, prior to version 16.3.0 contains an SQL injection vulnerability in the date filter. Four date parameters are concatenated directly into SQL without escaping or type validation. An unauthenticated attacker can read the entire database, including user password hashes. The issue is patched in version 16.3.0.

Hirschmann HiSecOS devices prior to version 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled. Remote attackers can submit a password longer than 128 characters to crash the device or execute arbitrary code.

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

A specific API endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

An authentication bypass vulnerability in Hirschmann Industrial HiVision prior to versions 06.0.07 and 07.0.03 allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges via the master service.

ZimaOS prior to version 1.5.3 exposes a proxy endpoint (/v1/sys/proxy) that can be abused (via an externally reachable domain using Cloudflare Tunnel) to make requests to internal localhost services. This allows unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel.

Microsoft Bing contains a Server-Side Request Forgery (SSRF) vulnerability that allows an unauthorized attacker to elevate privileges over a network.