CVEs

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without re-resolving the user from the database. Any authenticated Postiz user could forge a SUPERADMIN session and impersonate arbitrary organizations. This allowed Full Access to the following: all parts of Postiz, including users regi

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The app registers a custom org.traccar.client://config deep-link scheme that silently writes attacker-supplied parameters (server URL, device ID, accuracy, distance, and interval) into the app's persistent

Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination fi

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.

Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.