Export limit exceeded: 98040 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (98040 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71241 | 1 Lyric777 | 1 Book-management-system | 2026-08-10 | 7.5 High |
| Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication. | ||||
| CVE-2026-71239 | 1 Djangocrm | 1 Django-crm | 2026-08-10 | 8.1 High |
| DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern. | ||||
| CVE-2026-71236 | 1 Grocy | 1 Grocy | 2026-08-10 | 8.7 High |
| Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification. | ||||
| CVE-2026-71235 | 1 Absmach | 1 Magistrala | 2026-08-10 | 8.8 High |
| Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). | ||||
| CVE-2026-71234 | 1 Documize | 1 Community | 2026-08-10 | 7.5 High |
| Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. | ||||
| CVE-2026-71233 | 1 Invoiceninja | 1 Invoice Ninja | 2026-08-10 | 8.7 High |
| InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. | ||||
| CVE-2026-71232 | 1 Magicblack | 1 Maccms | 2026-08-10 | 7.2 High |
| MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. | ||||
| CVE-2026-71215 | 1 Art-template | 1 Art-template | 2026-08-10 | 7.5 High |
| art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. | ||||
| CVE-2026-71211 | 1 Mlflow | 1 Mlflow | 2026-08-10 | 7.1 High |
| MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. | ||||
| CVE-2026-71209 | 1 Advplyr | 1 Audiobookshelf | 2026-08-10 | 7.5 High |
| audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. | ||||
| CVE-2026-71206 | 1 Go-shiori | 1 Shiori | 2026-08-10 | 8.2 High |
| Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. | ||||
| CVE-2026-71202 | 1 Kosinix | 1 Raster | 2026-08-10 | 7.5 High |
| The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. | ||||
| CVE-2026-70378 | 1 Theotherphil | 1 Imagecli | 2026-08-10 | 7.5 High |
| imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process. | ||||
| CVE-2026-70377 | 1 Theotherphil | 1 Imagecli | 2026-08-10 | 7.5 High |
| imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request. | ||||
| CVE-2026-70375 | 1 Hashbrowncms | 1 Hashbrown Cms | 2026-08-10 | 8.8 High |
| HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping. | ||||
| CVE-2026-70374 | 1 Hashbrowncms | 1 Hashbrown Cms | 2026-08-10 | 8.8 High |
| HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...). | ||||
| CVE-2026-70373 | 1 Koha-community | 1 Koha | 2026-08-10 | 8.8 High |
| Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding. | ||||
| CVE-2026-70372 | 1 Koha-community | 1 Koha | 2026-08-10 | 8.8 High |
| Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. | ||||
| CVE-2026-70371 | 1 Koha-community | 1 Koha | 2026-08-10 | 8.8 High |
| Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters. | ||||
| CVE-2026-70370 | 1 Koha-community | 1 Koha | 2026-08-10 | 8.8 High |
| Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation. | ||||