Threat database

CVE-2026-114123 is a vulnerability in dynamics365ninja's d365fo-mcp-server prior to version 1.11.0 where missing authentication allows unauthenticated access to critical read-only functions. The default deployment leaves the API key unset or empty, causing the server to accept unauthenticated JSON-RPC requests. This exposes proprietary X++ source code snippets and metadata, including business logic and security roles. The issue is fixed in version 1.11.0.

Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.

Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.

Chamilo LMS versions from 2.0.0-alpha.1 up to but not including 2.0.0-RC.3 have a missing access control vulnerability in the GradebookController. This flaw allows unauthenticated users to modify gradebook certificates by accessing the set_default_certificate endpoint with arbitrary course and document IDs. The vulnerability has a medium severity with a CVSS score of 6.9.

A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called 6dfa0f4de45afc1b27333304b4cd4532db478f74/dd3e4d32971efca4197eb2df97f69de25a786e3c/119773d45c31da53b44cbfdb3f4910bc983cc7b0/cb6fe2127e587603451c609b4ed78c0293fcc3fa. It is best practice to apply a patch to resolve this issue.

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

Mall4cloud versions up to 4.0 contain an insecure direct object reference vulnerability that allows authenticated merchants to access other shops' buyer shipping addresses. This occurs via the OrderController's getOrderAddr handler, where attackers can enumerate orderAddrId values to retrieve consignee names, mobile numbers, addresses, and post codes across the platform.

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.

libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values past the zone genarray, corrupting heap memory and crashing Swami or other consumers.

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.

BottleCRM versions 0.45 through 1.14.5 have a vulnerability in the _read_upload() function where the application reads entire CSV uploads before enforcing the 5 MB size limit. Authenticated users with mass-import permission can exploit this by sending oversized CSV files concurrently to specific import endpoints, causing excessive memory consumption and potential out-of-memory termination.

BottleCRM versions 0.43 through 1.14.5 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated organization administrators can create routing rules with complex regex patterns that cause catastrophic backtracking. This leads to exhaustion of web workers shared across all tenants when the _match_condition() function evaluates these patterns during case saves.

BottleCRM versions up to 1.14.5 contain a server-side template injection vulnerability in the send_email Celery task. Authenticated organization members can exploit this by submitting template tags via a specific API endpoint to disclose rendering context and loaded Python modules or cause denial of service by blocking the Celery worker with nested loops. The vulnerability has a medium severity with a CVSS score of 5.3.

BottleCRM versions 0.30 through 1.14.5 have an HTML injection vulnerability in the render_invoice_template() function. Authenticated organization members can inject HTML and CSS into invoice PDFs via fields such as notes, terms, client name, or address. This allows attackers to manipulate the visual content of PDFs delivered through downloads, public links, and emails.

Koillection versions up to 1.8.4 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can upload HTML files as Datum file attachments without MIME type restrictions. These files are served as text/html from the public/uploads directory, allowing execution of malicious JavaScript in other users' sessions. This can lead to unauthorized actions performed on behalf of victims.

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability can lead to information disclosure, privilege escalation, and further impact on Confidentiality, Integrity, and Availability.

CVE-2025-58774 is a high-severity vulnerability in AMI AptioV BIOS involving buffer access with an incorrect length value. It can be triggered by local users, potentially causing buffer overflows, memory corruption, and arbitrary code execution. This vulnerability affects confidentiality, integrity, and availability of the system.

AMI APTIOV contains vulnerabilities in BIOS where users may cause  "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

AMI APTIOV contains vulnerabilities in BIOS where users may cause  “Classic Buffer Overflow” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Integer Overflow or Wraparound” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability.