SQLite command-line shell versions through 3.54.1 have a command injection vulnerability in the .recover command. This flaw allows attackers to craft a database schema containing malicious dot-commands such as .shell or .system, which are emitted verbatim by the .recover command. When a victim pipes the output of .recover into sqlite3, these commands execute arbitrary OS commands.
SQLite versions prior to 3.54.0 have a stack exhaustion vulnerability in the countOfViewOptimization() function. This flaw can be triggered by executing a count(*) query over a large multi-row VALUES clause or by supplying a crafted view with deeply nested TK_PLUS expressions. The recursive freeing of these expressions in sqlite3ExprDeleteNN() exhausts the C stack, leading to a denial of service by crashing the host process.
OpenCart versions up to 4.1.0.4 have a business logic vulnerability that allows authenticated customers to place unpaid full-price orders by manipulating reward points after selecting the Free Checkout option. Attackers can apply reward points, save the Free Checkout selection, then submit zero points via the reward.save function, causing the order confirmation process to proceed without payment.
phpMyAdmin versions through 5.2.3 have an SQL injection vulnerability that allows authenticated users to inject SQL via unescaped col_extra and col_attribute parameters in the /database/central-columns endpoint. This injection affects INSERT and UPDATE queries on the pma__central_columns table executed with controluser privileges, potentially enabling attackers to read or modify other users' configuration-storage data.
Uptime Kuma versions through 2.5.8 have a race condition vulnerability in the Socket.IO first-run setup handler. This flaw allows unauthenticated attackers to create an additional administrator account by sending concurrent setup requests during the bcrypt hashing process. Exploitation enables attackers to bypass the empty user table check and subsequently modify monitors, API keys, and toggle authentication settings.
phpMyAdmin versions up to 5.2.3 have an authentication bypass vulnerability in the CustomServer::parseAndValidateAssertionResponse() function. This flaw occurs because the function does not verify WebAuthn assertion signatures against stored public keys. An attacker with valid MySQL credentials can exploit this by sending a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor authentication and gain database privileges.
Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 have a vulnerability in the core_grades_get_gradeitems web service. This flaw allows authenticated course users to view grade items that are intended to be hidden from them by bypassing capability checks. The vulnerability exposes hidden grade item IDs, names, and categories via AJAX or mobile web service calls.
Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain a path traversal vulnerability in the Blackboard question import format. This flaw allows teachers with question import or lesson edit permissions to upload crafted zip files with image source paths containing '../' sequences, enabling them to copy server files such as config.php into their draft area.
OpenLiteSpeed versions through 1.9.4 have an authentication bypass vulnerability affecting HTTP/3 connections. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting the QuicStream's verifyContext() method, which incorrectly always returns true. Attackers can use a non-mTLS host's SNI combined with a protected Host header to access content that should be protected.
Jellyfin versions through 12.4 have an authorization bypass vulnerability in the SuggestionsController.GetSuggestions endpoint. This flaw allows authenticated users without administrator privileges to bypass library and parental restrictions by omitting the userId parameter in requests. Exploitation enables attackers to enumerate restricted items, including their IDs and server filesystem paths, and stream those items without proper authorization.
Moodle versions 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and up to 4.5.15 contain an SQL injection vulnerability in the External database enrolment plugin. This flaw allows editing teachers to inject a payload via the course idnumber field, which executes during scheduled synchronization with MySQL/MariaDB external databases. The vulnerability can lead to unauthorized reading of data and manipulation of enrolment results.
n8n versions from 2.14.0 through 2.46.3 have a path traversal vulnerability in the Databricks node. This flaw allows unauthenticated attackers to inject unencoded resource identifiers containing ../ sequences and query strings via inputs mapped to spaceId, indexName, or filePath. Exploitation can lead to unauthorized access to arbitrary Databricks API endpoints and reading of secrets stored in credentials.
Moodle versions 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 have an information disclosure vulnerability in the core_grades_get_feedback web service. This vulnerability allows non-editing teachers to access grade feedback and user identity information, including email addresses, from other groups due to missing group-membership and enrolment checks.
OPNsense core versions up to 26.7.8 have a configuration injection vulnerability that allows authenticated users with specific privileges to inject arbitrary directives into the ntpd.conf file. This is achieved by embedding newline characters in the fudge and refid fields via specific PHP service endpoints. The vulnerability affects ntpd running as root, potentially leading to integrity and availability impacts.
phpMyAdmin versions up to 5.2.3 have a vulnerability where authenticated attackers can bypass two-factor authentication (2FA) by sending a specially crafted request to the /config/set endpoint. This allows attackers with a hijacked session to disable 2FA, making subsequent logins require only the MySQL password.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 have a path traversal vulnerability in the restore-repo feature. This flaw allows attackers to read files outside the intended dump directory by supplying crafted asset paths containing '../' sequences. Specifically, attackers can manipulate the release.yml file's DownloadURL or PatchURL to import arbitrary files as release attachments during repository restoration.
Lago versions through 1.55.0 have an authorization bypass vulnerability in the Invoices::Payments::StripeService component. This flaw allows users from one organization to mark invoices belonging to another organization as paid due to an unscoped invoice lookup. Attackers with control over their organization's Stripe integration can exploit this by signing a payment_intent.succeeded event containing a victim's invoice UUID, enabling unauthorized wallet top-ups or access to payment-gated subscriptions.
Forgejo versions through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to submit crafted OpenID identifier URLs to the /user/login/openid endpoint, causing the server to issue blind discovery GET requests to internal resources such as loopback addresses, cloud metadata services, and other internal network addresses. The vulnerability enables port scanning and probing of internal systems without authentication.
Jellyfin versions up to 12.4 have an information disclosure vulnerability in the PlaylistsController.GetPlaylist function. Authenticated users can access hidden item IDs by requesting public or shared playlists. This allows restricted or parental-controlled users to obtain GUIDs of library items they should not access and potentially stream hidden media. The vulnerability has a low severity score and does not impact integrity or availability.
Jellyfin versions through 12.4 have a server-side request forgery (SSRF) vulnerability that allows authenticated users to bypass the SvgSecurityValidator by embedding gzip-compressed SVG content within non-SVG image data URIs. This enables attackers to upload crafted profile images via the POST /UserImage endpoint and then trigger unauthenticated rendering through GET /UserImage, potentially fetching internal URLs, reading local image files, or causing memory exhaustion.