Open Source Vulnerabilities
Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads
Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads
LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts
LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id
AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id
WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects
cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects
Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
domain-admin before 1.6.79 Missing Authorization via getGroupUserList
domain-admin before 1.6.79 Missing Authorization via getGroupUserList
PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 OS Command Injection via togglex Plugin
dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata
dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata
ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following
ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following
Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler
Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler
Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers
Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers
smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests
Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests
SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
