CVE Vulnerability Catalog

A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.

A SQL injection vulnerability was found in OPMS (lock-upme) up to a specific commit, affecting an unknown function in the file controllers/messages/message.go of the IN Clause Handler component. Manipulating the ids argument allows remote attack. The product uses a rolling release strategy, so specific versions are not provided.

A vulnerability was found in DedeCMS up to version 5.7.118 UTF8SP2, leading to file inclusion in the _4_Setup function of the file install/index.php in the Installation Wizard component. The attack can be executed remotely but is characterized by high complexity and difficult exploitability. The exploit has been publicly disclosed.

A missing authorization vulnerability exists in Dolibarr ERP up to 23.0.3 in the TakePOS module in htdocs/takepos/invoice.php. The fail function leads to missing authorization. The attack can be performed remotely. A patch is available.

A SQL injection vulnerability exists in itsourcecode Hospital Management System 1.0 in /viewdoctor.php. Manipulating the delid argument allows remote SQL queries. The exploit is public.

A missing authorization vulnerability exists in code-projects Task Management System 1.0 in /user/UpdateTaskStatus.php. Manipulating task_id/val arguments leads to missing authorization. The attack can be launched remotely. The exploit is public.

A server-side request forgery (SSRF) vulnerability exists in anubissbe ProjectHub-Mcp up to 5.0.0 in backend-fix/complete_backend.js in the Webhooks API component. Manipulating the url argument allows remote exploitation. The project has not responded.

A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcp_servers/mermaid/index.ts of the component generate_mermaid_markdown. The manipulation of the argument folder/name leads to path traversal. The attack must be carried out locally.

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component read_webpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This patch is called f071d491b685011ca04e8ab8d586fc65f86bcee1. It is advisable to implement a patch to correct this issue.

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access. Upgrading to version 2.2.7 is capable of addressing this issue. The patch is named 9c7a7839e690bb4543f0e7481b5740d23808e5fe. It is advisable to upgrade the affected component.

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.

The Create WordPress plugin before version 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.

The WP Photo Album Plus WordPress plugin before version 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.

The Create WordPress plugin before version 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and make it publicly available.

The Solace Extra WordPress plugin before version 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.

The LWS Optimize WordPress plugin before version 4.1.2 improperly escapes a value submitted through an unauthenticated analytics endpoint before storing and rendering it in the admin dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9, in the file src/index.ts. Manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product uses a rolling release, so no version details are available. The project was informed but has not responded.