CVE Vulnerability Catalog

Deserialization vulnerability in ash_cloak allows an attacker who can influence encrypted column bytes to crash the BEAM node via unbounded atom creation or decompression bomb during decryption. Unsafe deserialization without :safe option causes atom leak and compressed data inflation.

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The vulnerability affects the function mysqli_query in the file student_dashboard.php of the component Student Dashboard. Manipulation of the argument roll_no results in improper authorization. The attack can be performed remotely. The exploit is public. The project has not responded yet.

A security vulnerability has been detected in Linux Foundation Magma 1.9.0. The vulnerability affects an unknown functionality in the file tasks/ngap/ngap_amf.c of the component gNB Termination Handler. The manipulation leads to denial of service. The attack can be carried out remotely. The exploit has been disclosed publicly.

A weakness has been identified in Linux Foundation Magma 1.9.0 in an unknown function of the file ngap_amf_handlers.c of the NGSetup Handler component. Manipulation can lead to a state issue. The attack can be executed remotely, and the exploit is publicly available.

A security flaw has been discovered in Linux Foundation Magma 1.9.0 in an unknown function of the NGSetupRequest Handler component. Manipulating the NG-IoT-DefaultPagingDRX argument results in improper input validation. Remote exploitation is possible, and the exploit has been released publicly. The project was informed but has not responded.

Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows authenticated low-privilege users to read another user's future role memberships. Attackers can bypass profile-level authorization by directly calling the reload_future_memberships endpoint with a victim's user UUID to disclose sensitive membership information.

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted.

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path only to the workspace directory (util.IsAbsPathInWorkspace) but, unlike the file API's refuseToAccess() blocklist, applies no sensitive-path exclusion. This allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains the API token and cookie signing key. The issue is fixed in v3.8.1.

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.

A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Linux Foundation Magma 1.9.0 in an unknown function of the file tasks/amf/amf_fsm.cpp in the Registration Complete Message Handler component. Manipulation leads to improper authentication. The attack can be launched remotely, and the exploit has been made public.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0 in an unknown function of the file /pages/sup_searchfrm.php. Manipulation of the argument ID leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed.

In browser-use web-ui versions 2.0.0 through 3.0.0, configured LLM API keys are written to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

In browser-use web-ui versions 2.0.0 through 3.0.0, browser settings paths are not validated in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

A flaw was found in wger-project wger up to 2.6.0-alpha2 in the function reset_user_password of the file wger/gym/views/gym.py in the Password Reset component. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. A patch is recommended.

Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint that allows low-privileged users to render arbitrary Jinja templates by supplying raw template strings. Attackers with print permission on any document can execute arbitrary SELECT statements against unrelated tables, including reading password hashes from the __Auth table.

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.