CVE Vulnerability Catalog

AIOHTTP prior to version 3.14.2 contains a request smuggling vulnerability related to WebSocket upgrades. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data.

Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account.

OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the certificate description field. An authenticated attacker can inject arbitrary HTML or JavaScript via the trust certificate API, and the unsanitized description is rendered in the Dashboard Certificates widget, causing script execution in the browser of any authenticated user.

OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the firewall rule description field. An authenticated attacker with firewall rule management privileges can inject arbitrary HTML or JavaScript via the filter API endpoint, and the unsanitized description is rendered through the default cell formatter in opnsense_bootgrid.js, causing script execution in the browser of any authenticated user.

Litestar prior to version 2.22.0 contains a vulnerability in AllowedHostsMiddleware that allows an attacker to bypass allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. Since X-Forwarded-Host is client-controllable, this enables host header injection attacks.

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability. An unauthenticated attacker can send a single request to any short URL, supplying malicious values in User-Agent, Referer, or request path headers that begin with formula-triggering characters (=, +, -, @). When the exported visit data CSV is opened in a spreadsheet application, DDE or WEBSERVICE formulas are executed on the administrator's client machine.

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments via an unvalidated direction value in the orderBy parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flow unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets.

Shlink contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to force the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can use URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information.

A vulnerability was detected in Blix Email Blue Mail Calendar App version 2.2.305 in the FileDirectory.getDataColumn/FileDirectory.getFileFromUri function of the react-native-receive-sharing-intent component. Manipulation of the _display_name argument leads to path traversal. The attack requires local access. The exploit is public. The vendor did not respond.

A vulnerability was found in danpros HTMLy up to version 3.1.1 in the unknown code of file /system/htmly.php of the Author Name Handler component. Manipulation of the Name argument leads to path traversal. The attack can be launched remotely. The exploit is public. The vendor did not respond.

A vulnerability was found in danpros HTMLy up to version 3.1.1 in the add_content function of file /system/admin/admin.php of the Admin Content Endpoint component. Manipulation of the oldfile argument leads to path traversal. The attack can be launched remotely. The exploit is public. The vendor did not respond.

The ip-address library for JavaScript versions 10.1.1 through 10.2.2 contains a vulnerability where special-use classification methods (isLoopback, isPrivate, isLinkLocal, isCGNAT, isMulticast, isUnspecified, isBroadcast, isULA, getType) rely on isInSubnet, which returns false when the address's subnet mask is shorter than the reference range's mask. Appending a CIDR suffix like /0 causes all these methods to report an internal address as unremarkable, while correctForm() and address still return the real internal target. Applications using these checks for network trust-boundary decisions, such as SSRF filters, may treat an internal target as external and allow the request. Fixed in version 10.2.2.

Reflected XSS vulnerability in the oaskit library for Elixir. The flaw is due to missing HTML escaping in the default error handler, which renders request validation failures as HTML pages. An attacker can craft a malicious link that executes arbitrary JavaScript in the victim's browser within the application's origin.

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability.

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the allow_unredacted_secrets=false policy. Attackers can retrieve access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs, especially impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain is reachable.

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server before 2.0.24 allows a remote unauthenticated attacker (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context.

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint.

A vulnerability in danpros HTMLy up to 3.1.1, affecting the unlink function in /system/htmly.php of the Delete Username Endpoint component, allows manipulation of the File argument leading to path traversal. The attack can be launched remotely, and the exploit is publicly available.

A security flaw in langgenius dify up to 1.14.2, affecting the jinja2.Template function in api/core/helper/code_executor/jinja2/jinja2_transformer.py of the Jinja2 Handler component, results in improper neutralization of special elements used in a template engine. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability in jeequan jeepay up to 3.2.9, affecting the WebSecurityConfig function in jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the PreAuthorize Handler component, leads to authorization bypass. The attack can be initiated remotely, and the exploit is publicly available.