CVE Vulnerability Catalog

A security vulnerability has been detected in HeyCyan App 1.0.103 on Android, affecting an unknown functionality of the FileProvider component. The manipulation leads to improper access controls and the attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in EyouCMS up to version 1.8.3, affecting the remote_file_to_local function in application/function.php. Input manipulation can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

A security flaw was found in SourceCodester Performance Indicator System 1.0 affecting /opils/staff/save_profile.php. Manipulating the Contact argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.

A vulnerability was identified in SourceCodester Performance Indicator System 1.0 affecting /opils/staff/edit_dealer.php. Manipulating the Contact argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.

A vulnerability was found in SourceCodester Performance Indicator System 1.0 affecting the file /opils/staff/adddealer.php. Manipulating the Contact argument leads to SQL injection. The attack can be launched remotely and a public exploit exists.

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request with a large Content-Length to exhaust server memory. The read buffer grows to the declared length before data arrives, causing an out-of-memory exit. The server runs as a single process, so it stays down until restarted.

Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The decoder does not limit chunk-size line length or buffer size. A remote attacker can exhaust worker memory with a single connection.

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. A hex line followed by a bare LF and CRLF never matches, and each attempt backtracks quadratically. Line length is unbounded.

Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only headers. Bodies are read with blocking reads and no deadline. An attacker can occupy all workers with a few connections.

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync.

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts parameters that delete PagePrincipale, configuration pages, or overwrite current content.

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple authenticated victim sessions that evade IdP-driven revocation.

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google SSO and regain sessions at their original permission level, including admin.

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, or delete files belonging to other tenants.

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive, causing selfupdate to install an attacker-controlled rclone executable.

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine can send prompt_logprobs (or echo with logprobs) against a connector-cached prefix, making tokenizer decode raise OverflowError, which crashes EngineCore and drops all co-tenant requests.

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every frame, exhausting memory and crashing the API frontend.

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker and deny service to co-tenants.