HTTP::Parser::XS versions before 0.18 for Perl contain a vulnerability where the PATH_INFO is truncated at an encoded null byte (%00) during HTTP request parsing. This occurs because the XS parser URL-decodes the request path and uses strlen(), which stops at the first null byte, causing the application to route on a shorter path than the full request path. The pure-Perl backend is not affected. This discrepancy can be exploited by a remote attacker to send a path that a proxy or filter checks in full, while the application processes a truncated version.
CallBackery versions before 0.60.1 for Perl contain a path traversal vulnerability in the /doc route that allows unauthenticated clients to read arbitrary files accessible to the server process. This occurs because the documentation plugin mounted at /doc passes user input to Pod::Simple::Search->find without validation, enabling traversal outside the intended directory. The vulnerability is fixed in version 0.60.1.
phpMyAdmin versions up to 5.2.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.
vsftpd versions through 3.0.5 have an access control bypass vulnerability that allows authenticated FTP users to execute commands that should be denied. This occurs because the process_post_login() function's cmds_denied check compares literal tokens and does not properly handle RFC 775 X-prefixed aliases. Attackers can exploit this by sending commands such as XRMD, XMKD, XCWD, XPWD, or XCUP to perform restricted operations like deleting directories.
vsftpd versions through 3.0.5 have an authentication bypass vulnerability in the ssl_data_accept() function. This flaw allows unauthenticated attackers who share the victim's source IP to hijack FTPS data connections by resuming their own TLS session ticket. Attackers can obtain a ticket via AUTH TLS and then connect to the victim's PASV port to steal downloads or inject upload data.
Prometheus versions up to 3.15.1 have a credential leak vulnerability that enables attackers to capture Azure AD or Google IAM bearer tokens. This occurs when remote_write requests are redirected to a malicious host, allowing token replay and unauthorized metric writes to the victim's backend.
Plausible Analytics versions up to 3.2.1 have a mass assignment vulnerability in the update_traffic_change_notification function. Authenticated site editors can exploit this flaw by supplying a site_id parameter to reassign traffic change notifications to another site. This allows them to receive traffic alerts and visitor data for sites they do not own or manage.
Plausible Analytics Community Edition versions through 3.2.1 have an information exposure vulnerability that allows site editors to view pending invitation and ownership-transfer IDs. An attacker who obtains these IDs can register using the invitee's email and accept the invitation, thereby gaining the invited role or taking ownership of the site.
SQLite command-line shell versions through 3.54.1 have a command injection vulnerability in the .recover command. This flaw allows attackers to craft a database schema containing malicious dot-commands such as .shell or .system, which are emitted verbatim by the .recover command. When a victim pipes the output of .recover into sqlite3, these commands execute arbitrary OS commands.
SQLite versions prior to 3.54.0 have a stack exhaustion vulnerability in the countOfViewOptimization() function. This flaw can be triggered by executing a count(*) query over a large multi-row VALUES clause or by supplying a crafted view with deeply nested TK_PLUS expressions. The recursive freeing of these expressions in sqlite3ExprDeleteNN() exhausts the C stack, leading to a denial of service by crashing the host process.
OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows authenticated customers to place unpaid full-price orders by manipulating reward points after selecting the Free Checkout option. Attackers can apply reward points, save the Free Checkout selection, then submit zero points via the reward.save function, causing the order confirmation process to proceed without payment.
phpMyAdmin versions through 5.2.3 have an SQL injection vulnerability that allows authenticated users to inject SQL via unescaped col_extra and col_attribute parameters in the /database/central-columns endpoint. This injection affects INSERT and UPDATE queries on the pma__central_columns table executed with controluser privileges, potentially enabling attackers to read or modify other users' configuration-storage data.
Uptime Kuma versions through 2.5.8 have a race condition vulnerability in the Socket.IO first-run setup handler. This flaw allows unauthenticated attackers to create an additional administrator account by sending concurrent setup requests during the bcrypt hashing process. Exploitation enables attackers to bypass the empty user table check and subsequently modify monitors, API keys, and toggle authentication settings.
phpMyAdmin versions up to 5.2.3 have an authentication bypass vulnerability in the CustomServer::parseAndValidateAssertionResponse() function. This flaw occurs because the function does not verify WebAuthn assertion signatures against stored public keys. An attacker with valid MySQL credentials can exploit this by sending a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor authentication and gain database privileges.
Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 have a vulnerability in the core_grades_get_gradeitems web service. This flaw allows authenticated course users to view grade items that are intended to be hidden from them by bypassing capability checks. The vulnerability exposes hidden grade item IDs, names, and categories via AJAX or mobile web service calls.
Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain a path traversal vulnerability in the Blackboard question import format. This flaw allows teachers with question import or lesson edit permissions to upload crafted zip files with image source paths containing '../' sequences, enabling them to copy server files such as config.php into their draft area.
OpenLiteSpeed versions through 1.9.4 have an authentication bypass vulnerability affecting HTTP/3 connections. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting the QuicStream's verifyContext() method, which incorrectly always returns true. Attackers can use a non-mTLS host's SNI combined with a protected Host header to access content that should be protected.
Jellyfin versions through 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. This flaw allows authenticated users without administrator privileges to bypass library and parental restrictions by omitting the userId parameter in requests. Exploitation enables attackers to enumerate restricted items, including their IDs and server filesystem paths, and stream those items without proper authorization.
Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain an SQL injection vulnerability in the External database enrolment plugin. This flaw allows editing teachers to inject a payload via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. The vulnerability can lead to unauthorized reading of data and manipulation of enrolment results.
n8n versions from 2.14.0 through 2.46.3 have a path traversal vulnerability in the Databricks node. This flaw allows unauthenticated attackers to inject unencoded resource identifiers containing ../ sequences and query strings via inputs mapped to spaceId, indexName, or filePath. Exploitation can lead to unauthorized access to arbitrary Databricks API endpoints and reading of secrets stored in credentials.