CVE Vulnerability Catalog

The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service then joins the request path with this empty path and canonicalizes it, causing Rust to resolve it as a relative path. As a result, an attacker can request paths that resolve relative to the application's working directory and access unintended files.

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header.

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.

A flaw was found in the libdm library that allows a local attacker to craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This can lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

The Bit Form plugin for WordPress, up to and including version 3.2.0, is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.

The Epeken All Kurir for WooCommerce plugin through version 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.

The Embed Google Photos album WordPress plugin through version 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

The affiliate-toolkit plugin for WordPress, up to and including version 3.8.8, is vulnerable to time-based SQL Injection via the 'orderby' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.

The Astro Booking Engine plugin for WordPress up to version 1.4.0 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the options deletion functionality. This allows unauthenticated attackers to delete all plugin settings via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0 in the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to SQL injection. The attack can be executed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in francoisjacquet RosarioSIS up to version 12.8 in the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation is possible. Upgrading to version 12.9 addresses the issue.

A vulnerability was found in RosarioSIS up to version 12.7.4, in the student medical module. Manipulation of the 'table' argument in Medical.inc.php leads to SQL injection. The attack can be launched remotely.

A flaw was found in RosarioSIS up to version 12.8, affecting the DBUpdate function in Discipline/Referrals.php. This manipulation causes an authorization bypass. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was identified in fm-mcp-servers version 0.0.3, affecting the downloadReport function in src/smadex-reporting/src/index.ts. Manipulation of the downloadUrl argument leads to server-side request forgery (SSRF). The attack can only be performed from a local environment.

A weakness was identified in Hospital Management System version 1.0, affecting the file viewdoctortimings.php. Manipulation of the delid argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A security flaw was discovered in swagger-testcase-mcp (commit 5babb27c951fb404bc2b25ec80593616e49054e5), affecting the loadSource function in src/utils/swagger-parser.ts. Manipulation results in server-side request forgery (SSRF). The attack can be carried out remotely, and the exploit is public.

A vulnerability was found in DTStack Taier version 1.4.0, affecting the MultipartFile.getOriginalFilename function in UploadController.java. Manipulation of the File argument leads to path traversal. The attack can be initiated remotely.

A vulnerability in lamp-cloud up to version 5.10.0 affects an unknown part of DefGenProjectController.java in the Code Generator component. Manipulation of outputDir/parent/projectPrefix arguments leads to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.

OpenChoreo prior to versions 1.0.3, 1.1.3, and 1.2.0-rc.2 has a vulnerability in the POST /api/v1alpha1/autobuild endpoint. Webhook provider selection relies on attacker-controlled X-Event-Key, and Bitbucket requests are accepted without HMAC-SHA256 verification. This allows unauthenticated build triggers for components matched by repository URL and branch, including cross-provider attacks using attacker-supplied commit SHAs.