CVE Vulnerability Catalog

A security vulnerability was detected in aircheng-org iWebShop-5 in the send_message_mobile function (controllers/simple.php). Manipulation of the user_id argument leads to weak password recovery. The exploit is publicly disclosed and can be launched remotely.

A weakness was identified in aircheng-org iWebShop-5 in the IController::redirect function (plugins/_userInfo/_userInfo.php) within the Login Redirect component. Manipulation of the callback argument causes an open redirect. The exploit is publicly available and can be initiated remotely.

A security flaw was discovered in aircheng-org iWebShop-5 in the admin_repwd/admin_repwd_act function (controllers/system.php) within the Password Change component. Manipulation of the password/repassword arguments results in cross-site request forgery. The exploit is publicly released and can be launched remotely.

A vulnerability was identified in aircheng-org iWebShop-5 in the Util::search function (classes/util.php). The manipulation leads to SQL injection. The exploit is publicly available and can be initiated remotely.

A cross-site scripting vulnerability was found in Chamilo LMS in the TicketManager::addProject function (file main/inc/lib/TicketManager.php) via manipulation of the Name argument. The attack may be performed remotely and the exploit has been publicly disclosed. A patch is available.

A vulnerability was found in diem-project diem up to 5.1.3 affecting the file dmCorePlugin/lib/data/dmDataLoad.php. Manipulation leads to use of default password, and the attack can be carried out remotely. The exploit has been made public and could be used.

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD routing daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the authorized range. BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. The rule can pass validation and be propagated to downstream peers.

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The handler emits the id value into an unquoted HTML attribute; esc_attr() does not encode spaces, allowing injection of additional HTML attributes including JavaScript event handlers. Authenticated attackers with Contributor-level access and above can inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.

In diem-project diem, in file lib/model/doctrine/PluginDmUser.class.php (SHA1 Handler component), manipulation of the salt/password argument leads to password hashes with insufficient computational effort. The attack requires local access and high complexity, and the exploit has been publicly disclosed.

A flaw has been found in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) affecting the file App/Home/Controller/VoteController.class.php of the Vote Handler component. Manipulation of the X-Requested-With argument causes business logic errors. Remote exploitation is possible, and the exploit has been published and may be used.

A vulnerability was detected in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) affecting the file_exists function in Public/Home/js/uploadify/check-exists.php of the Uploadify component. Manipulation of the filename argument results in file and directory information exposure. The attack may be launched remotely, and the exploit is now public and may be used.

In light0011 cms, in the sha1 function of file App/Home/Model/UserModel.class.php, manipulation of the Password argument leads to password hashes with insufficient computational effort. The attack may be initiated remotely and requires high complexity, and the exploit has been publicly disclosed.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

A weakness has been identified in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) in App/Home/Controller/UserController.class.php of the Captcha Validation component. The manipulation leads to improper access controls, the attack can be launched remotely, and the exploit is publicly available. The project was informed but has not responded.

In Gitea, seven API routes under /api/v1/users/{username} (followers, following, following/{target}, starred, subscriptions, keys, and gpg_keys) were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could read the followers, following list, starred and watched repositories, and public SSH and GPG keys of a user with limited or private visibility. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.

When deleting a label, the repository ID from the request was compared against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to a repository's issues could delete the labels of an organization with the same numeric ID as that repository. Labels are now deleted only within their own repository or organization.

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to a repository's releases, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size, and download count of the attachment through the release and allowed the user to rename or delete it.

The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.