phpMyAdmin versions through 5.2.3 have an SQL injection vulnerability that allows authenticated users to inject SQL via unescaped col_extra and col_attribute parameters in the /database/central-columns endpoint. This injection affects INSERT and UPDATE queries on the pma__central_columns table executed with controluser privileges, potentially enabling attackers to read or modify other users' configuration-storage data.
Uptime Kuma versions through 2.5.8 have a race condition vulnerability in the Socket.IO first-run setup handler. This flaw allows unauthenticated attackers to create an additional administrator account by sending concurrent setup requests during the bcrypt hashing process. Exploitation enables attackers to bypass the empty user table check and subsequently modify monitors, API keys, and toggle authentication settings.
phpMyAdmin versions up to 5.2.3 have an authentication bypass vulnerability in the CustomServer::parseAndValidateAssertionResponse() function. This flaw occurs because the function does not verify WebAuthn assertion signatures against stored public keys. An attacker with valid MySQL credentials can exploit this by sending a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor authentication and gain database privileges.
Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 have a vulnerability in the core_grades_get_gradeitems web service. This flaw allows authenticated course users to view grade items that are intended to be hidden from them by bypassing capability checks. The vulnerability exposes hidden grade item IDs, names, and categories via AJAX or mobile web service calls.
Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain a path traversal vulnerability in the Blackboard question import format. This flaw allows teachers with question import or lesson edit permissions to upload crafted zip files with image source paths containing '../' sequences, enabling them to copy server files such as config.php into their draft area.
OpenLiteSpeed versions through 1.9.4 have an authentication bypass vulnerability affecting HTTP/3 connections. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting the QuicStream's verifyContext() method, which incorrectly always returns true. Attackers can use a non-mTLS host's SNI combined with a protected Host header to access content that should be protected.
Jellyfin versions through 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. This flaw allows authenticated users without administrator privileges to bypass library and parental restrictions by omitting the userId parameter in requests. Exploitation enables attackers to enumerate restricted items, including their IDs and server filesystem paths, and stream those items without proper authorization.
Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain an SQL injection vulnerability in the External database enrolment plugin. This flaw allows editing teachers to inject a payload via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. The vulnerability can lead to unauthorized reading of data and manipulation of enrolment results.
n8n versions from 2.14.0 through 2.46.3 have a path traversal vulnerability in the Databricks node. This flaw allows unauthenticated attackers to inject unencoded resource identifiers containing ../ sequences and query strings via inputs mapped to spaceId, indexName, or filePath. Exploitation can lead to unauthorized access to arbitrary Databricks API endpoints and reading of secrets stored in credentials.
Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 have an information disclosure vulnerability in the core_grades_get_feedback web service. This vulnerability allows non-editing teachers to access grade feedback and user identity information, including email addresses, from other groups due to missing group-membership and enrolment checks.
OPNsense core versions up to 26.7.8 have a configuration injection vulnerability that allows authenticated users with specific privileges to inject arbitrary directives into the ntpd.conf file. This is achieved by embedding newline characters in the fudge and refid fields via specific PHP service endpoints. The vulnerability affects ntpd running as root, potentially leading to integrity and availability impacts.
phpMyAdmin versions up to 5.2.3 have a vulnerability where authenticated attackers can bypass two-factor authentication (2FA) by sending a specially crafted request to the /config/set endpoint. This allows attackers with a hijacked session to disable 2FA, making subsequent logins require only the MySQL password.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 have a path traversal vulnerability in the restore-repo feature. This flaw allows attackers to read files outside the intended dump directory by supplying crafted asset paths containing '../' sequences. Specifically, attackers can manipulate the release.yml file's DownloadURL or PatchURL to import arbitrary files as release attachments during repository restoration.
Lago versions through 1.55.0 have an authorization bypass vulnerability in the Invoices::Payments::StripeService component. This flaw allows users from one organization to mark invoices belonging to another organization as paid due to an unscoped invoice lookup. Attackers with control over their organization's Stripe integration can exploit this by signing a payment_intent.succeeded event containing a victim's invoice UUID, enabling unauthorized wallet top-ups or access to payment-gated subscriptions.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to submit crafted OpenID identifier URLs to the /user/login/openid endpoint, causing the server to issue blind discovery GET requests to internal resources such as loopback addresses, cloud metadata services, and other internal network addresses. The vulnerability enables port scanning and probing of internal systems without authentication.
Jellyfin versions up to 12.4 have an information disclosure vulnerability in the PlaylistsController.GetPlaylist function. Authenticated users can access hidden item IDs by requesting public or shared playlists. This allows restricted or parental-controlled users to obtain GUIDs of library items they should not access and potentially stream hidden media. The vulnerability has a low severity score and does not impact integrity or availability.
Jellyfin versions through 12.4 have a server-side request forgery (SSRF) vulnerability that allows authenticated users to bypass the SvgSecurityValidator by embedding gzip-compressed SVG content within non-SVG image data URIs. This enables attackers to upload crafted profile images via the POST /UserImage endpoint and then trigger unauthenticated rendering through GET /UserImage, potentially fetching internal URLs, reading local image files, or causing memory exhaustion.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 have an information disclosure vulnerability in the GetPublicKey API handler. This flaw allows authenticated users with read:user tokens or sessions to enumerate sequential key IDs and retrieve titles, fingerprints, and public key material of other users' SSH, deploy, and principal keys. The vulnerability arises due to a missing ownership check on key lookups.
OPNsense core versions before 26.7.8 have a configuration line injection vulnerability. Authenticated users with wireless-edit privileges can inject arbitrary directives by embedding carriage return and line feed characters in WPA fields such as wpa.identity, wpa.passphrase, or RADIUS shared secrets. This allows attackers to append unauthorized wpa_supplicant or hostapd directives that are loaded by root-run daemons.
OPNsense core versions prior to 26.7.8 have a log injection vulnerability that allows unauthenticated attackers to submit specially crafted WebGUI login usernames. This can cause victim IP addresses to be planted in the lockout_handler, resulting in the victim being blocked from SSH and WebGUI access and disruption of pf states.