CVE Vulnerability Catalog

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps.

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the component Secret Resolution. The manipulation of the argument api_key leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_management_endpoints.py of the component Spend Tracking. Executing a manipulation of the argument session_id can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 1.96.0 can resolve this issue. This patch is called 722d9ffa4f6c5ae15702ab9ab2c5f6bf1688308b. The affected component should be upgraded.

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function IOStreamBuffer::getNextBlock of the component PLY File Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0, affecting the CasP3ProxyValidate function in controllers/cas.go of the Proxy Validation component. Manipulation of the pgtUrl argument leads to server-side request forgery. The attack can be performed remotely and the exploit has been publicly disclosed.

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6, impacting the kqjcmdModel::returnchuli function in webmain/task/openapi/openkqjAction.php of the Openkqj Action component. Manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95, affecting the RunCompile function in framework/Furion/ViewEngine/Engines/ViewEngine.cs of the View Engine component. Manipulation of the content argument results in improper neutralization of special elements used in a template engine. The attack can be executed remotely and the exploit is publicly available.

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92, impacting the String.Replace function in framework/Furion/Templates/Extensions/StringRenderExtensions.cs. Manipulation of the Name argument leads to SQL injection. Remote exploitation is possible and the exploit is publicly available.

A vulnerability was determined in InstantSoft icms2 up to 2.18.2, affecting the validatePaypalOrder function in system/controllers/billing/actions/paypal.php of the Billing Module component. Manipulation of the bid/sig arguments leads to insufficient verification of data authenticity. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in InstantSoft icms2 up to 2.18.2, impacting the files_delete_file function in system/fields/image.php of the Image Handler component. Manipulation of the size argument results in path traversal. The attack can be initiated remotely and the exploit is publicly available. The patch is named 03d70937f1ff97031523222808726994b8b79379.

A vulnerability was found in InstantSoft icms2 up to version 2.18.2. The index function in templates/default/controllers/messages/index.tpl.php of the Private Message Handler component is affected, and manipulation of the nickname argument leads to cross-site scripting. The attack can be launched remotely, and the exploit has been publicly disclosed. The patch is named 3a1ec8fcb073a46d06a2ab83bc2bf68225834281.

A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android, affecting the word.office.docxviewer.document.docx.reader.ViewTxt function. Manipulation of the _display_name argument leads to path traversal. The attack can be performed remotely.

A vulnerability was determined in ag2ai ag2 up to 0.13.4, affecting the os.path.join function of the UserProxyAgent component. Manipulation of the filename argument causes path traversal. The attack can be carried out remotely and the exploit has been publicly disclosed.

A vulnerability was found in 021is elvix-sdk up to 0.10.1, affecting an unknown functionality of src/mcp/index.ts of the MCP Request Handler component. Manipulation of the path argument results in server-side request forgery. The attack can be executed remotely and the exploit is publicly available.

The WP-Invoice WordPress plugin through version 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names, and profile details of all registered users.

The Piotnet Forms WordPress plugin through version 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).