CVE Vulnerability Catalog

Wallos before version 5.0.0 allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. An attacker can break out of the current VEVENT block and insert attacker-controlled calendar events, including spoofed organizers and email addresses, into any calendar application subscribed to that feed.

Wallos from version 2.0.0 to before 5.0.0 allows any authenticated user (no admin rights required) to make the server open arbitrary outbound SMTP connections to internal/link-local addresses by setting the SMTP host of their personal email notifications to an internal IP. Lack of SSRF validation in the notification settings endpoint and the notification cron leads to connections to the chosen host:port.

A vulnerability was found in QuantumNous new-api up to version 1.0.0-rc.15 in the file /api/usage/token/ of the Revoked API Token Handler component. Manipulation leads to session expiration. The attack can be performed remotely, and the exploit has been publicly disclosed. Upgrading to version 1.0.0-rc.17 resolves the issue.

MapSVG versions up to 8.15.0 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can make the server send requests to arbitrary resources, including internal ones, without authentication.

elFinder before version 2.1.70 does not protect the netmount command against CSRF attacks because it is not included in the list of protected commands. In the default configuration, FTP network mounts are enabled, and an attacker can control parameters such as protocol, host, port, user, password, allowing persistent mounting of an attacker-chosen FTP server in the victim's session and sending credentials without a CSRF token.

@hono/oauth-providers before version 0.8.6 accepts an OAuth callback even when the 'state' value is absent on both sides, making the 'state'-based anti-CSRF protection ineffective. An attacker can exploit this to perform CSRF attacks on social login.

Livewire from version 3.0.0-beta.1 to 3.8.3 and 4.3.4 has a vulnerability in the dot-notated query-string parser that accepts __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers treat inherited properties as trusted effects, allowing an unauthenticated attacker to execute arbitrary JavaScript in the application's origin when a user opens a crafted URL.

Cross Site Scripting (XSS) vulnerability in Kalles Addons up to version 1.0.6. A subscriber-level attacker can inject malicious scripts.

Broken Access Control vulnerability in Booking and Rental Manager up to version 2.7.6. Subscriber-level users can gain unauthorized access to functionality.

Broken Access Control vulnerability in OwnerRez API up to version 1.2.6. Subscriber-level users can gain unauthorized access.

Sensitive Data Exposure vulnerability in Print Barcode Labels for your WooCommerce products/orders up to version 4.0.0. Subscriber-level users can access sensitive data.

Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.

FastGPT Community Edition versions 4.10.0 through 4.14.0 are vulnerable to NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.

Kirby is an open-source CMS. Prior to 4.9.5 and 5.5.2, the media handler used incomplete filesystem containment checks, allowing access to files in sibling directories if the path shared a common prefix. A remote attacker could create and access thumbnails from image files in a sibling directory, potentially exposing staging sites, backups, or other internal sites.

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.

Smarty is a template engine for PHP. Prior to 4.5.7 and 5.8.2, the {fetch} handling used Security::isTrustedUri() to validate only the initial remote URL, and PHP followed HTTP redirects by default. An attacker with an open redirect on a trusted host could redirect the request to an internal endpoint, bypassing the trusted_uri allowlist and performing SSRF.

backpack/crud provides CRUD functions for Backpack, a Laravel package collection. From 6.0.0 until 6.8.14 and 7.0.37, the methods SingleBase64Image::uploadFiles and uploadRepeatableFiles accept any data URI starting with data:image without validating MIME subtype or decoded bytes. An authenticated administrator can store arbitrary file content under an extensionless filename, which can cause stored XSS or other unintended behavior.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, the endpoint currency/update_exchange.php loads the first Fixer/API Layer credential globally instead of the authenticated user's credential. A normal authenticated user without their own provider key can trigger exchange-rate refreshes using another user's stored provider credential.

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement_subscription_id to a subscription ID belonging to another user. The stats logic later dereferences that foreign ID without user_id scoping, allowing the attacker to infer the victim's monthly-normalized cost.

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.