CVE Vulnerability Catalog

A vulnerability was detected in NginxProxyManager (nginx-proxy-manager) up to version 2.15.1 in the internalCertificate.validate function of the file backend/internal/certificate.js (Validate Route component). Manipulation results in missing authentication, and the attack can be launched remotely. The exploit is now public and may be used; the endpoint only processes and echoes back the certificate submitted by the caller, and the real risk is unauthenticated openssl processing of attacker input.

A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A security flaw in Dromara UJCMS up to 12.3.1 affects the usernameExist function in ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the UserController component. Manipulation of the Username argument results in improper authorization. The attack can be remote. The project has not responded yet.

Vulnerability in Pixelfed up to 0.12.11 affects the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php of the OAuth Scope Handler component. Manipulation of the ID argument leads to missing authentication. The attack can be remote, and the exploit is public. Upgrading to 0.12.10 is recommended (though description says 0.12.11, recommended is 0.12.10 – likely a typo).

The SmartLife app dynamically generates new authentication parameters at runtime. Using them, an attacker can directly register an account with any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified before registration.

Vulnerability in olivier-ls PHP-FTS up to 1.1.3 affects the SearchEngine::matchesSingleFilter function in src/SearchEngine.php of the Filter Matching component. The manipulation leads to incorrect comparison. Remote exploitation is possible, and the exploit is public. Upgrading to 1.1.4 mitigates the issue.

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used.

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined, and Mint.HTTP1.decode_body/5 discards bytes up to the CRLF, so lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ as the terminating chunk. This issue affects mint from 0.1.0 before 1.10.1.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

OpenPanel API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream(). These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

The Partial Shipment for Woocommerce plugin for WordPress in versions up to and including 3.4 is vulnerable to Missing Authorization via the 'wxp_order_shipment', 'wxp_order_item_shipment', and 'wxp_order_set_shipped' AJAX actions. Lack of capability checks, nonce verification, and order ownership validation allows authenticated attackers with Subscriber-level access and above to read arbitrary order item details and modify shipment status of any order.

The Empik for Woocommerce plugin for WordPress in all versions up to and including 1.5.1 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to modify arbitrary WooCommerce product metadata, including Empik logistic class, product state, and export/offer flags.

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress in all versions up to and including 2.6.65 is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to create and cancel real shipping orders via the external logistics API, modify arbitrary WooCommerce order post meta, overwrite the plugin's stored API token, and trigger shipping notification emails.