CVE Vulnerability Catalog

Adminer 4.16.0 through 6.0.1 contain a pre-authentication SSRF vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect() before login validation, an unauthenticated attacker can submit crafted auth parameters to cause the Adminer server to issue an HTTP GET request to an arbitrary reachable host and port. The driver does not block loopback, private, link-local, or other reserved addresses; if no port is given it appends default 9200, and the generic port check rejects ports below 1024. Selected JSON error fields and connection failures are rendered on the login page, providing a port-scanning oracle. Exploitation requires the optional Elasticsearch driver to be deployed and allow_url_fopen enabled.

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.

Hugo, a static site generator, in versions from v0.56.0 through v0.165.x renders content files mapped to the text/org media type without escaping raw HTML. Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting (XSS) in the generated site. Only pages whose source file or content-adapter output declares the text/org media type are affected; version v0.166.0 fixes the issue by introducing a security.allowContent allowlist that denies text/org by default.

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted lineAnchors value supplied as a Markdown code fence attribute (or passed to the highlight template function) results in unescaped HTML in the rendered page, allowing arbitrary JavaScript to execute in the browsers of visitors. Fixed in 0.166.0, where the lineAnchors value is HTML-escaped before being passed to Chroma.

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the name field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw path value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL, and removed via shutil.rmtree() when force_remove is used. Fixed in GitPython 3.1.62.

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrieve sensitive application details including navigation structure, role names, internal screen URLs, JavaScript snippets, and user identifiers without authorization checks.

Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attackers with Builder access can intercept unredacted datasource objects containing database passwords and API keys by observing table save or delete operations.

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an attacker-controlled serviceUrl that is persisted and used for all subsequent bot replies, causing the server to send live Microsoft OAuth access tokens in Authorization headers to the attacker's host and enabling blind internal network access.

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, relying only on IP-based rate limiting. An attacker who knows a password can guess TOTP codes by reusing MFA challenge tickets and distributing guesses across IP addresses to bypass rate limiting and gain account access.

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. An unauthenticated attacker can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. An authenticated user can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter is allowlisted but lacks the sandbox guard, allowing access to the raw DI container and disclosure of the full configuration tree, including credentials and secrets, to anonymous visitors.

grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content gated by the authenticated() Twig function or the [authenticated] shortcode. On sites with 2FA enabled, Login::isAuthenticated() checked only the session flag indicating that the password step had succeeded, not the flag indicating that login had completed, so a session at the 2FA code prompt was treated as fully authenticated. An attacker who knows a member's password but cannot answer the second factor can read member-only content.

Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single HEADERS frame containing both fields with differing, attacker-controlled values; the request is accepted and delivered to the application with two conflicting authorities, allowing routing, virtual-host, and access-control decisions to be bypassed when different components in the request path consult different fields. This issue is fixed in 4.2.18.Final.

vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but validates only that the values are integers, not that each token id is within the model vocabulary/logits range. When min_tokens > 0, the stop token ids are used as logits indices to suppress stop tokens, so an out-of-range id reaches a CUDA indexing operation (index_put_) and triggers a device-side assertion. An authenticated API user can send a single malformed completion request that returns 500 Internal Server Error and puts EngineCore into a fatal state, causing subsequent requests to fail until the service is restarted (denial of service).

In vLLM versions 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures. This causes pinned deployments to still resolve behavior-affecting artifacts from the repository's default revision, potentially altering audio preprocessing, speech tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. This is a supply-chain integrity and reproducibility failure, but not remote code execution or a trust_remote_code=False bypass. Fixed in version 0.28.0.

vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token IDs to reach MinTokensLogitsProcessor. Attackers can submit requests with min_tokens greater than zero and out-of-vocabulary stop_token_ids to trigger CUDA tensor indexing failures that leave EngineCore in a fatal state requiring service restart.

vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request contains a 'features' (multimodal) payload, caller-supplied token_ids are not checked against model_config.max_model_len, and for multimodal processors reporting skip_prompt_length_check=True an overlong prompt reaches the worker input-batch copy into a fixed max_model_len-wide NumPy row. A client able to reach the endpoint can trigger a worker failure and denial of service.

vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and per-modality --limit-mm-per-prompt item limits). Across four ingress paths the server reads the entire HTTP response body, base64-decodes the inline payload, or spawns one fetch/decode task per media part, and only then applies the limit (or never applies it). A remote attacker can cause pre-inference memory and bandwidth exhaustion (denial of service).