CVE Vulnerability Catalog

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product is published by multiple vendors.

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetch_article of the file news_scraper_mcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

In PhialsBasement KoboldCPP-MCP-Server 1.0.0, a weakness was found in the makeRequest function of src/index.ts (BaseConfigSchema component). Manipulation of the apiUrl argument leads to server-side request forgery (SSRF). The attack can be launched locally.

In Handwriting-OCR handwriting-ocr-mcp-server 0.1.0, a vulnerability was found in the fs.readFileSync function of src/index.ts (upload_document component). Manipulation of the File argument leads to path traversal. The attack requires local access.

In Nikolaibibo claude-comfyui-mcp 1.0.0, a vulnerability was found in the copyFileSync function of src/tools/utils.ts (comfy_upload_image component). Manipulation of the image_path argument leads to path traversal. The attack must be performed locally.

In bartekke8it56w2 new-mcp 0.1.0, a vulnerability was found in the fs.writeFileSync/fs.existsSync/fs.readFileSync functions of index.ts (geminithinking component). Manipulation of the sessionCommand/sessionPath arguments leads to path traversal. The attack requires local access.

In KS-GEN-AI jira-mcp-server 0.2.0, a vulnerability was found in the axios.get function of src/index.ts (add_attachment_from_public_url component). Manipulation of the imageUrl argument leads to server-side request forgery (SSRF). The attack requires local access.

In NocteDefensor LudusMCP 1.0.24, a vulnerability was found in an unknown function of src/tools/rangeConfig.ts (read_range_config component). Manipulation of the Source argument leads to server-side request forgery (SSRF). The attack may be initiated remotely.

In NocteDefensor LudusMCP up to version 1.0.24, a vulnerability was found in an unknown function of src/tools/insertCredsRangeConfig.ts (insert_creds_range_config component). Manipulation of the configPath/outputPath arguments leads to path traversal. The attack is restricted to local execution.

In Ichigo3766 image-gen-mcp 0.1.0, a vulnerability was found in an unknown function of src/index.ts (upscale_images component). Manipulation of the output_path argument leads to path traversal. The attack must be performed locally.

Uncontrolled resource consumption vulnerability in ash-project ash allows an attacker to exhaust node memory via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex, which base64-decodes the value and passes it to :erlang.binary_to_term/2 without bounding its size. The Erlang external term format supports zlib-compressed payloads, which the decoder inflates transparently, so a cursor of a few kilobytes can allocate tens of megabytes of heap in a single call. Ash itself only ever encodes cursors uncompressed, so the decoder accepts a term shape its encoder never produces. Concurrent requests aggregate these allocations and can terminate the node.

A vulnerability in itsourcecode Hospital Management System 1.0 affects an unknown function in the file /viewdoctorconsultancycharge.php. Manipulation of the argument delid causes SQL injection. The attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack can be executed remotely. src/handler.rs logs raw Authorization header values and complete bearer tokens/JWTs on authentication failure paths, potentially exposing credentials through CloudWatch Logs. src/models.rs serializes the complete validated JWT claims set with serde_json::to_string(token_claims).unwrap() and propagates it through context["jwtClaims"] to downstream integrations. This code performs serialization, not deserialization, and does not process attacker-controlled jwtClaims input. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability in lmammino oidc-authorizer 0.4.0 affects the function parse_token_from_header in src/parse_token_from_header.rs of the Authorization Header Parsing component. Manipulation of the argument authorization_token leads to denial of service. Remote exploitation is possible. The exploit has been disclosed and may be used. The vendor did not respond to early contact.

A vulnerability in Perl's regular expression engine (up to version 5.45.1) causes out-of-bounds reads and writes during pattern matching. The issue stems from an integer overflow in the superlinear cache counter, leading to undersized allocation and subsequent out-of-bounds access.

A vulnerability was detected in ExcelLexBot up to version 0.0.3, related to improper privilege management in the ExcelLexBotS3TriggerFunction of the Lambda Function Handler component. The attack can be initiated remotely. The product is no longer supported by the maintainer.

A security vulnerability was detected in nxp-auto-goldvip gvip up to version 1.4.0, related to improper access controls in the SitewiseCustomFunction of the Lambda Function Handler component. The attack can be launched remotely. The issue is resolved in version 1.15.0.

A weakness was identified in 3CORESec Trapdoor up to version 1.2.2, related to improper access controls in the DefaultFunction. The attack can be initiated remotely. The vendor was contacted about the issue.

A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.