CVE Vulnerability Catalog

Unauthenticated Broken Access Control vulnerability in Booking and Rental Manager versions up to 2.7.5. Allows unauthorized access to functions or data without authentication.

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

Outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service (DoS) condition due to an unbounded memory leak. Affected versions include Micrometer 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling legitimate requests and causing a denial of service that prevents the DJI Fly application from retrieving photos and videos from the aircraft in QuickTransfer mode. Remediation requires a firmware update from the vendor.

The Joomla extension Page Builder CK before version 3.6.5 is vulnerable to a reflected XSS attack via the iscontenttype parameter. The attack can be executed remotely.

The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addresses' function. Due to improper generation of error messages, an unauthenticated attacker with network access to the web interface can retrieve the logged MAC addresses via browser developer tools.

A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

A security flaw was discovered in expo-share-intent up to version 8.0.0 in the getDataColumn function of ExpoShareIntentModule.kt in the Android File Copy Routine component. Manipulation of the _display_name argument results in path traversal. The attack requires local access.

A flaw was found in Open5GS up to version 2.8.0 in an unknown function of src/hss/hss-cx-path.c in the HSS component. Manipulation of the User-Name argument causes a reachable assertion. The attack can be carried out remotely, and the exploit has been published.

A vulnerability was detected in Sales and Inventory System 1.0 in an unknown function of /pages/cust_edit.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely, and the exploit is now public.

A vulnerability was identified in phaser3-rex-notes up to version 1.80.17 in the SetValue function of plugins/utils/object/SetValue.js in the BehaviorTree Blackboard Data Interface component. Manipulation of the key argument leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.

NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school.

NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.

A vulnerability was found in TanStack devtools-vite 0.7.0 in the installPackage function of packages/devtools-bundler-core/src/package-manager.ts of the Development Devtools Event Bus component. Manipulation of the packageName argument results in OS command injection. The attack requires local access and is difficult to exploit, but the exploit has been made public.

A security flaw was discovered in provectus kafka-ui up to 0.7.2 in the executeSmartFilterTest function of kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the Groovy Code Handler component. The manipulation results in code injection. The attack can be launched remotely, and the exploit has been released.

In BentoML, the outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381.

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed.

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3 in the unknown processing of the file /user/note.php of the User Notes Handler component. Manipulation of the ID argument leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 addresses this issue.

A flaw has been found in Open5GS 2.8.0 in the unknown code of the AMF UEContextReleaseRequest Path Handler component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely.