A vulnerability in GoBGP v4.4.0 through v4.4.x allows an unauthenticated remote BGP peer to cause a denial of service by sending a malformed BGP UPDATE message. The malformed message triggers a nil pointer dereference in the AdjRib.Update function, causing the GoBGP process to crash and resulting in loss of service availability. This issue is fixed in version 4.5.0.
A server-side request forgery (SSRF) vulnerability exists in monetr's Lunch Flow integration in versions prior to 1.12.5. This flaw allows any authenticated user on a self-hosted instance with default settings to make the server issue HTTP GET requests to arbitrary URLs. The vulnerability arises because the URL validator does not block internal or cloud metadata addresses, and the server reflects response bodies from non-200 HTTP responses in API error messages. This can expose sensitive internal resources, including cloud instance metadata. Additionally, an attacker can cause a denial-of-service by triggering large response bodies to be buffered in memory. The hosted monetr service is not affected as Lunch Flow is disabled by default. The issue is fixed in version 1.12.5.
A remote Denial of Service (DoS) vulnerability exists in GoBGP versions prior to 4.3.0. It is triggered by a malformed BGP UPDATE message containing improperly ordered AS4_PATH and AS_PATH attributes, causing a runtime panic due to an out-of-bounds slice access. This crash leads to the GoBGP process terminating, resulting in loss of routing capabilities.
A remote Denial of Service (DoS) vulnerability exists in GoBGP versions 4.3.0 up to but not including 4.4.0. The flaw is caused by a nil pointer dereference when the daemon processes a malformed BGP UPDATE message containing an unrecognized Path Attribute marked as "Well-known." This leads to a panic and crash of the GoBGP daemon, disrupting BGP session handling.
October Rain CMS has a server-side information disclosure vulnerability in its INI settings parser due to environment variable interpolation via the `${}` syntax in `parse_ini_string()`. Attackers with Editor access can inject environment variable references like `${APP_KEY}` or `${DB_PASSWORD}` into CMS page settings, causing sensitive environment variables to be exposed when the page is reopened. This vulnerability requires authenticated backend Editor permissions and is relevant only when `cms.safe_mode` is enabled. The issue has been patched in versions 3.7.14 and 4.1.10.
October Rain contains a stored cross-site scripting (XSS) vulnerability in its SVG sanitization logic. The flaw allows bypassing the regex pattern that strips event handler attributes, enabling malicious SVG files to execute scripts when viewed or embedded. Exploitation requires authenticated backend access with media upload permissions. The vulnerability is patched in versions 3.7.14 and 4.1.10. Users should upgrade or apply recommended workarounds to mitigate risk.
CVE-2026-32689 is a high-severity unauthenticated denial-of-service vulnerability in the Phoenix web framework's long-poll transport. It allows a remote attacker to cause large memory allocations via specially crafted HTTP requests with an application/x-ndjson POST body. This can exhaust server memory with only a few concurrent requests. The flaw affects Phoenix versions from 1.7.0 up to but not including 1.7.22 and from 1.8.0 up to but not including 1.8.6. The vulnerability is fixed in versions 1.7.22 and 1.8.6. Exploitation requires no authentication and targets LiveView apps or Phoenix.Socket instances using longpoll. No known exploits are reported in the wild.
Rust russh versions prior to 0.60.1 contain a pre-authentication denial-of-service vulnerability in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server implementing keyboard-interactive authentication with a single malformed packet without needing credentials. This vulnerability has been fixed in version 0.60.1.
Admidio versions prior to 5.0.9 contain an incomplete fix for a Server-Side Request Forgery (SSRF) vulnerability in the fetch_metadata.php module. The vulnerability arises because the code validates the resolved IP address of a hostname but then passes the original hostname-based URL to cURL, which independently resolves the hostname again. This creates a time-of-check to time-of-use (TOCTOU) window allowing DNS rebinding attacks to redirect requests to internal IP addresses such as AWS metadata endpoints or localhost. The issue is fixed in version 5.0.9.
CodeIgniter Shield's authentication filter does not enforce user deactivation immediately for active sessions. When a user is deactivated (active=0) after login, their session remains valid and they retain backend access until the session expires (default 7200 seconds). This occurs because the check for the 'active' field is commented out and never enforced, allowing deactivated users to continue operating with valid sessions.
An authenticated admin in ci4-cms-erp/ci4ms versions >=0.31.1.0 and <0.31.8.0 can exploit a vulnerability in the deleteProcess() action to drop arbitrary database tables. The action accepts a POST parameter 'tables[]' with table names that are not validated against the theme's migration files, allowing deletion of any table in the database. This can lead to severe disruption including deletion of authentication tables.
Admidio's OIDC token introspection endpoint incorrectly returns an active status for all tokens without validating them, allowing any token, including fabricated or expired ones, to be accepted as valid. Additionally, the token revocation endpoint falsely reports successful revocation without actually invalidating tokens. This leads to authentication bypass on resource servers relying on this introspection and prevents revocation of compromised tokens.
Admidio's SAML Identity Provider (IdP) implementation in its SSO module fails to validate the AssertionConsumerServiceURL (ACS URL) from incoming SAML AuthnRequest messages against the registered ACS URL for the service provider (SP). This allows an attacker who knows a registered SP's Entity ID to craft a malicious AuthnRequest with an arbitrary ACS URL, causing the IdP to send signed SAML responses containing user identity attributes to an attacker-controlled endpoint. The vulnerability exists because the ACS URL from the request is used directly without verification, violating SAML 2.0 security requirements. Signature validation is optional and disabled by default, further enabling exploitation. A fix is available in Admidio version 5.0.9.
Admidio versions prior to 5.0.9 contain a vulnerability in their SAML Identity Provider implementation where signature validation results are ignored. This flaw allows unsigned or invalidly signed SAML AuthnRequests and LogoutRequests to be processed as if they were validly signed. Consequently, an attacker can forge authentication and logout requests, potentially impersonating users or terminating their sessions without proper signature verification.
Admidio versions prior to 5.0.9 have a CSRF vulnerability in the administrative preferences module. Several state-changing operations—database backup, test email sending, and .htaccess file writing—are triggered via GET requests without CSRF token validation. This allows an attacker to trick an authenticated administrator into performing these actions by visiting a malicious page. The vulnerability can cause server resource exhaustion, disruption of application routing or security headers, and unauthorized email sending.
Admidio versions prior to 5.0.9 contain a vulnerability where the function responsible for removing users from roles does not check if removing an administrator leaves the system without any administrators. This allows an administrator to remove the last other administrator, potentially locking all administrative access. Recovery requires direct database intervention. A fix is available in version 5.0.9.
Admidio versions prior to 5.0.9 are vulnerable to a reflected cross-site scripting (XSS) flaw in the system/msg_window.php endpoint. The vulnerability arises because user input containing square brackets is passed through htmlspecialchars() which does not encode brackets, and then these brackets are converted to angle brackets by a placeholder processing function, resulting in executable HTML/JavaScript. This allows unauthenticated attackers to execute arbitrary JavaScript in any user's browser by crafting a malicious URL. The application does not set Content-Security-Policy headers, so the injected scripts execute without restriction. A fix is available in version 5.0.9.
A vulnerability in Admidio before version 5.0.9 allows role leaders with assign-only permissions to infer hidden personal information fields such as birthdays, street addresses, cities, postal codes, and countries. This occurs because the server-side search query includes these hidden fields in its SQL LIKE condition without filtering by visibility, enabling a blind oracle attack. Although the JSON output hides these fields, the search results reveal which users match specific hidden values by filtering the user list accordingly.
Admidio's inventory module has a missing authorization check on several destructive backend endpoints, allowing any authenticated user with access to the inventory module to delete, retire, reinstate items, and manipulate item pictures without admin privileges. The UI only hides buttons for these actions from non-admin users but does not enforce authorization on the server side. This flaw enables permanent deletion of inventory items and associated data, including bulk deletions, causing irreversible data loss without backups.
Admidio versions prior to 5.0.9 contain a path traversal vulnerability in the documents module's add mode. The vulnerability arises from insufficient input validation of the 'name' parameter, allowing directory traversal sequences to register arbitrary server files into document folders. This endpoint lacks CSRF protection and uses SameSite=Lax cookies, enabling an attacker with low privileges to trick a documents administrator into registering sensitive server files (e.g., configuration files) accessible to the attacker. The vulnerability allows reading arbitrary server files via the documents interface.