Chamilo LMS versions before 1.11.40 and from 2.0.0-alpha.1 up to but not including 2.0.1 contain multiple eval() calls in the PEAR HTML_QuickForm libraries that can lead to arbitrary PHP code execution if attacker-controlled data influences form element names. Standard Chamilo forms use hardcoded element names, so exploitation requires a developer-specific plugin or misconfiguration allowing user input to reach these element names. Successful exploitation can result in full server compromise. The vulnerability is fixed in versions 1.11.40 and 2.0.1.
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `save_profile`, and `delete_profile` actions in `public/main/inc/ajax/skill.ajax.php` perform database mutations without `Security::check_token()` validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the database without the `allowed_classes: false` safety option. An attacker able to write crafted serialized PHP objects to that column, for example through a separate SQL injection, a compromised admin CSV import, or a lower-privilege admin panel, can instantiate arbitrary PHP objects and trigger POP gadget chains in autoloaded `Symfony`, `Doctrine`, or `Monolog` components. This permits arbitrary OS commands as the web server user, compromising server confidentiality, integrity, and availability. This issue is fixed in version 2.0.1.
Chamilo LMS versions 2.0.0 up to but not including 2.0.1 contain a stored cross-site scripting (XSS) vulnerability in the user profile page. The vulnerability arises because six user-editable profile fields are rendered without proper server-side sanitization, allowing a user with the ROLE_STUDENT role to inject malicious HTML. This malicious content executes in the browsers of visitors viewing the profile, including administrators, potentially enabling account takeover through session or token theft. The issue is fixed in version 2.0.1.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_<name>.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Google service-account JSON key into that same web-served directory. In `backend/app/integrations/scoutsuite/services/scoutsuite.py`, `generate_gcp_report_background` removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
CVE-2026-61729 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.76. It involves missing authentication for critical webhook functions due to a publicly hardcoded fallback header value used for authentication. This allows an anonymous attacker to bypass JWT authentication and invoke sensitive API endpoints that can execute commands on Wazuh managers and submit forged alerts, potentially disrupting endpoint defenses and manipulating alert data. The issue is fixed in version 0.1.76.
CVE-2026-61728 is a critical stored cross-site scripting (XSS) vulnerability in socfortress CoPilot versions prior to 0.1.76. It allows authenticated portal users to inject malicious scripts via incident comments and other fields, which are rendered without proper sanitization. Exploitation can lead to theft of authentication tokens, enabling persistent privileged account takeover, cross-tenant data access, and manipulation of incidents. The vulnerability is fixed starting from version 0.1.76.
CVE-2026-111487 is an out-of-bounds write vulnerability in the Qt Framework's assimp scene import plugin within the Qt3D module. It affects multiple versions of Qt Framework starting from 6.5.0 up to but not including 6.8.10, 6.9.0 up to but not including 6.11.3, and 6.12.0 up to but not including 6.12.1. The vulnerability has a medium severity score of 4.3 and does not have known exploits in the wild. Fixed versions are available.
ManageEngine SharePoint Manager Plus versions from 450 up to but not including 4507 contain an improper access control vulnerability in the multi-factor authentication (MFA) functionality. A low-privileged authenticated user can bypass authorization checks to read and modify MFA settings, enable or disable MFA, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Exploitation could weaken authentication protections or cause denial of service by misconfiguring MFA, potentially locking out legitimate users. This vulnerability is fixed in build 4507.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers to choose `bucket_name` and `object_name` without an allowlist, tenant prefix, ownership check or content restriction. The only file check requires a nonempty filename. The operations in `backend/app/data_store/data_store_operations.py` create missing buckets and upsert objects, allowing existing objects belonging to any tenant to be overwritten. Targets include `sysmon-configs/<customer_code>/sysmon_config.xml` distributed to managed Windows endpoints, `copilot-case-report-templates/<name>` rendered server-side, and case evidence or forensic artifacts under `copilot-cases/<case_id>/<file>` and `velociraptor-artifacts/<agent_id>/<flow_id>/<file>`. A lowest-privilege user can tamper with cross-tenant evidence, blind endpoint telemetry, poison report templates for later code execution, plant data or exhaust storage. Sibling list, download and delete routes remain restricted to admin/analyst; the exposed operation is the upload write path. This issue is fixed in version 0.1.76.
Vvveb CMS versions prior to 1.0.8.7 contain an improper authorization vulnerability (CWE-285) in the admin/auth-token endpoint. This allows an authenticated administrator to read and overwrite API tokens belonging to other administrators. The issue has been fixed in version 1.0.8.7.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
Tamery versions from 0.26.1 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's chatsMessages.update handler. This flaw allows authenticated Pro subscribers to manipulate the client-supplied chatId parameter, enabling them to move messages with arbitrary content into another user's AI chat history. The vulnerability is fixed in version 0.99.0.
Tamery versions from 0.32.0 up to but not including 0.99.0 contain an authorization bypass vulnerability in the cloud sync API's connectionsResources.create handler. This flaw allows authenticated users to attach resources to other users' connections by including a victim's connectionId in batch requests. The issue is fixed in version 0.99.0.
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
MuseBot versions prior to 2.0.0 contain a critical authentication bypass vulnerability due to the use of a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing session cookies with the default key, granting full administrative access. Exploitation enables attackers to read sensitive data such as password hashes, chat records, and bot configurations, and to stop bots. The vulnerability is fixed in MuseBot version 2.0.0.
Blossom versions up to 1.17.1 have an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' folders. This occurs because the FolderService only filters queries by folder ID, enabling attackers to supply another user's folder ID to endpoints such as /folder/info, /folder/upd, /folder/open, or /folder/del. Exploitation can lead to unauthorized reading of storage paths, renaming, toggling visibility, or deletion of folders.
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.