CVE Vulnerability Catalog

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress up to and including 3.9.2 is vulnerable to stored cross-site scripting via the 'atkp_product_producturl' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user accesses the page if AJAX loading is enabled and a product ID is known; on a default installation, contributor-level access is required.

The AI Marketing Expert plugin for WordPress up to and including 1.2.8 is vulnerable to stored DOM-based cross-site scripting via the 'name' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator opens wp-admin/index.php, provided the chatbot module is active with at least one configured bot.

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

qEngine CMS, Kemana Directory, and Cart Engine contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.

Linksys WAG200G contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.

Integer overflow vulnerability in ProtobufParser._readStringKey() in the Jackson protobuf parser. A malformed protobuf message with a map key length of 0x7FFFFFFF causes signed arithmetic overflow in the bounds check, leading to an attempt to allocate a huge buffer and an OutOfMemoryError. StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not prevent the failure.

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes the value without the overflow guard present in the blocking parser, and _startRawBinary immediately allocates the declared length. A roughly ten-byte input can force an allocation of about 2 GB, causing OutOfMemoryError or NegativeArraySizeException.

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then calling _finishShortText(len), both using 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and TextBuffer.expandCurrentSegment(len) performs Arrays.copyOf with no cap and throws OutOfMemoryError. maxStringLength and maxDocumentLength do not gate this path.

In Nuxt Ollama prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests.

In GRR prior to version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges.

In Cronicle prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch.

In GRR prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it.

Use-after-free vulnerability in the Layout component of Google Chrome prior to 156.0.8078.73. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Modularization component of Google Chrome prior to 156.0.8078.73. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.