CTFd versions from 3.1.0 up to but not including 3.8.7 have an information disclosure vulnerability in the /api/v1/teams list endpoint. This flaw allows unauthenticated attackers to paginate through team data and access non-public custom field values such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
Foxel versions up to 2.4.0 have a missing authentication vulnerability that permits unauthenticated attackers to read arbitrary files. This occurs via the /api/fs/stream and /api/fs/thumb endpoints, where attackers can specify a VFS mount prefix and relative path to access full file contents or thumbnails, bypassing PathRule permission controls.
Label Studio versions before 1.23.2 and label-studio-sdk before 2.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows authenticated users to read internal URLs by exploiting image-bearing export formats. Attackers can import tasks with images pointing to internal services, export them in formats like YOLO or COCO to read responses, and spoof the Host header to capture the organization owner's API token.
Tactical RMM has a stored cross-site scripting (XSS) vulnerability due to improper input validation or output encoding in multiple fields. This flaw allows attackers to inject malicious HTML or JavaScript into the application database, which executes in users' browsers when viewing affected content. Exploitation can lead to account takeover or arbitrary code execution in the context of the user session.
An incomplete comparison vulnerability (CWE-1023) exists in the merge_chats() function of the whatstk library versions from 0.3.0 before 0.9.0. This flaw causes messages to be silently omitted from merged chat outputs when their timestamps overlap, as the merge logic discards messages from one chat if their dates fall within the range of the other chat. The merged result does not indicate any removals, potentially impacting forensic reviews or training data generation that rely on complete chat exports.
Dromara domain-admin versions prior to 1.6.79 have a missing authorization vulnerability in the POST /api/getGroupUserList endpoint. This flaw allows authenticated users to access member information of groups they do not belong to by enumerating group IDs. The exposed data includes usernames of members, leader and edit-permission flags, and owner usernames. The vulnerability has a medium severity with a CVSS score of 4.3.
Cotonti versions through 1.0.0 use md5(microtime()) to generate registration and email-change validation tokens. This method allows attackers to predict tokens by deriving the generation time from the HTTP Date header and computing candidate tokens offline. Exploiting this vulnerability enables bypassing email-ownership verification, potentially activating accounts or confirming email addresses without control over them.
cordova-plugin-advanced-http versions 1.5.0 through 3.3.1 have an information disclosure vulnerability that leaks cookies to third-party hosts. This occurs because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When requests are redirected to another host, the native iOS and Android stacks forward the Cookie header, potentially allowing attackers to hijack user sessions.
WPPConnect Server versions up to 2.10.74 have a missing authentication vulnerability that permits unauthenticated attackers to send WhatsApp messages via the Chatwoot webhook route. This occurs because the verifyToken middleware is not applied, allowing attackers who know or guess a connected session name to post outgoing message bodies and send arbitrary texts or files from that account to any number.
NVIDIA Slurm has a vulnerability that allows a user to alter the supplemental group list during an sbcast file transmission, enabling them to write files to unauthorized paths. This flaw could lead to unauthorized file writes, impacting confidentiality and integrity but not availability.
AuditPilot versions before commit 4669c93 have an authorization bypass vulnerability in the _metadata_allowed function within rag/agentic_rag.py. This flaw allows authenticated users with read:knowledge permission scoped to one project to access knowledge data from other projects by manipulating the project_id parameter in specific API endpoints.
PostfixAdmin versions through 4.0.5 have a stored cross-site scripting (XSS) vulnerability that affects authenticated mailbox users. This flaw allows these users to inject malicious scripts via the description field when creating a TOTP exception. When a global administrator views the affected page, the injected script executes in the admin's session context, potentially allowing unauthorized admin actions using the page's CSRF token.
nnn versions through 5.3 have an insecure temporary file vulnerability in the pdfread and nuke plugins. This flaw allows local attackers to overwrite files by exploiting predictable temporary file paths in /tmp. Attackers can create symbolic links at these predictable paths, causing the victim's plugin to truncate and overwrite arbitrary files writable by the victim user.
nnn versions through 5.3 have an insecure file handling vulnerability where the main() function accepts an existing NNN_FIFO path without verifying it is a FIFO. This allows local attackers to pre-create the predictable /tmp/nnn.fifo path as a symlink or regular file, potentially redirecting writes to overwrite victim-writable files or leak browsed paths.
Jarun nnn versions through 5.3 have an OS command injection vulnerability in the plugins/togglex component. This flaw allows attackers to execute arbitrary commands by placing specially crafted filenames containing shell syntax that are processed unsafely by xargs and sh -c. The vulnerability requires user interaction and local access to invoke togglex with the malicious filenames.
Koodo Reader versions through 2.4.6 have a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers. Authenticated attackers can exploit this by uploading a crafted books.db file with directory traversal sequences in the cover value, enabling them to read arbitrary files accessible to the server process outside the intended upload directory.
Dreeve versions before 5.8.0 have a missing authentication vulnerability in the StravaWebhookRequestHandler::handleEvent function. This flaw allows unauthenticated attackers to forge Strava webhook events without proper signature, verify-token, or owner_id validation. Exploitation can lead to attackers sending forged delete events with known public Strava activity IDs to the webhook URL, resulting in permanent deletion of imported activities and their associated data streams.
ruTorrent versions prior to 5.3.20 have a path traversal vulnerability in the datadir plugin. This flaw allows authenticated users to bypass directory restrictions by exploiting symbolic link resolution issues, enabling them to create directories and move torrent data to locations writable by the web server or rtorrent.
smart-sso versions through 2.0.1 have an incorrect authorization vulnerability in the PermissionFilter component. This flaw allows any authenticated user to access admin console APIs because unlisted paths are permitted by default. Exploitation enables attackers to call sensitive endpoints such as /admin/user-role/save to assign themselves administrator privileges, reset passwords, and manage users, roles, and applications across integrated systems.
Canop dysk versions before 3.8.2 have a terminal escape sequence injection vulnerability. This flaw allows local users to inject control sequences via crafted mount metadata that is rendered unsanitized in table and CSV outputs. By creating FUSE mounts with escape sequences in mount-point names or filesystem names, attackers can cause spoofed or hidden output and change the terminal window title when another user runs dysk.