free-fs versions 2.0.1 through 2.3.1 have an SQL injection vulnerability in the FileShareServiceImpl.getPages method. This flaw allows authenticated users to inject malicious SQL via the orderBy parameter in the /apis/share/pages endpoint, which is used directly in an ORDER BY clause without proper validation. Exploitation can lead to unauthorized reading of arbitrary database contents, such as share codes.
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.
Dromara free-fs versions 2.0.1 through 2.3.1 have a missing authentication vulnerability in the FileStreamController.preview function. This flaw allows unauthenticated attackers to download stored files by requesting the preview endpoint with a valid file ID. Attackers can obtain file IDs from share listings or preview links, enabling unauthorized access to any user's or workspace's files.
Dromara free-fs versions 2.0.1 through 2.3.1 have a stored cross-site scripting (XSS) vulnerability. Registered users can upload HTML files that are served inline as text/html, enabling execution of malicious scripts in the context of the application. Attackers can exploit this by sending victims a crafted preview link to execute scripts that interact with the application's API endpoints, potentially exposing victim files and account data.
Dromara free-fs versions 2.0.1 through 2.3.1 have an authorization bypass vulnerability due to client-side enforcement of share codes. Attackers who know a share ID can access and download files from code-protected shares without needing the share code, even for preview-only shares.
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.
Keep versions 0.34.10 through 0.55.0 contain a blind SQL injection vulnerability in the CEL-to-SQL converter. Authenticated users with read:alert permission can exploit this flaw by submitting crafted CEL expressions to specific endpoints, allowing them to extract other tenants' alerts and password hashes via a boolean oracle technique.
Seafile SeaDoc versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contain an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public share token to execute arbitrary code by supplying an absolute filename to a specific API endpoint, leading to malicious code importation.
PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid: references into attachment links. An unauthenticated SMTP sender can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious script, potentially allowing password changes including for administrators.
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.
FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because unsanitized text is returned when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing many nested blockquote markers followed by malicious HTML, enabling script execution that can steal the admin token from localStorage.
NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint via the id and locationType parameters. This flaw allows remote attackers to manipulate SQL commands, potentially reading database contents and accessing or modifying server files through PostgreSQL superuser functions. The vulnerability is critical with a CVSS 4.0 score of 9.3. A fix is available in version 1.6.26.
EdgeEver versions 1.9.0 up to but not including 2.13.0 contain a stored cross-site scripting (XSS) vulnerability in the backup restore endpoint. This flaw allows authenticated users to share a note with a crafted public blob link that causes a victim's browser to execute malicious script. The script can mint a non-expiring API token granting read and write access to the victim's notes. The vulnerability is fixed in version 2.13.0.
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4.
A cross-site scripting (XSS) vulnerability exists in rails-html-sanitizer versions prior to 1.7.2 due to unsafe reuse of a permit scrubber in multithreaded environments. Concurrent sanitization calls with different allowlists can cause one call to use another's permissive allowlist, potentially allowing script elements or event-handler attributes to bypass sanitization. This issue is fixed in version 1.7.2.
A vulnerability in rails-html-sanitizer versions 1.0.3 through 1.7.1 allows an attacker to cause uncontrolled resource consumption (CPU usage) by supplying crafted HTML with SVG reference elements and certain href attributes. This leads to quadratic CPU consumption due to inefficient regular expression matching in affected Ruby interpreters. The issue is fixed in version 1.7.2.
CVE-2026-123965 is a critical prompt injection vulnerability in all versions of Jet Admin Cloud Platform. It allows a remote attacker with a free account to access sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated around October 29, 2026, by implementing a sandbox component.
Catalis WebPro 5.0 contains a SQL Injection vulnerability that allows remote unauthenticated attackers to execute arbitrary SQL queries on the underlying MSSQL database. This can lead to unauthorized access and exfiltration of sensitive property and taxpayer information. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.