Author name: UNDERCODE

The vulnerability exists in the `/proxy` endpoint of Mailpit. This endpoint is designed to fetch external resources but improperly validates

This vulnerability exists in the MONAI framework’s `_download_from_ngc_private()` function. When downloading and extracting a bundle from a private NVIDIA NGC

The vulnerability in Pterodactyl arises from the Wings daemon’s handling of SFTP connections for server file access. When a user

The vulnerability in evershop 2.1.0 and prior is a blind Server-Side Request Forgery (SSRF) in the “GET /images” API endpoint.

The vulnerability exists in the Java Naming and Directory Interface (JNDI) lookup feature of Apache Log4j versions 2.0-beta9 through 2.14.1.

This vulnerability resides in the HTTP Range header parser within the aiohttp library. The component uses a regular expression designed

This CVE affects the `aiohttp` web framework when Python is run with optimizations enabled (-O or PYTHONOPTIMIZE=1). In this mode,

The vulnerability in AIOHTTP allows for denial of service through memory exhaustion when handling large payloads. It specifically affects servers

How the CVE Works CVE-2024-23334 exploits aiohttp’s request body decompression. The server automatically decompresses HTTP requests with Content-Encoding: deflate/gzip. A

This vulnerability operates within the `aiohttp.web` framework’s HTTP cookie parsing mechanism. When a client sends an HTTP request with a

The vulnerability exists within Vega’s internal `modify()` expression function, which is accessible through user-controlled specifications, notably via the `setdata` operation.

How the Mentioned CVE Works The vulnerability exploits the chunked transfer encoding mechanism in the aiohttp web server. Normally, this

The vulnerability in AIOHTTP’s static file serving via `web.static()` involves path normalization designed to prevent directory traversal. However, this normalization

The vulnerability operates through Spinnaker’s artifact providers that accept user-supplied URLs for data retrieval. When enabled, such as HTTP artifact

The vulnerability resides in the `vlSelectionTuples` function. Vega’s expression evaluator normally restricts arbitrary function calls. However, when an event object

The vulnerability is a path traversal bypass in the Apache Kyuubi Server’s file access controls. The server uses a configuration

The vulnerability exploits the Backup addon’s file export functionality in REDAXO. Authenticated users with backup permissions can manipulate the EXPDIR

The vulnerability exists in the ERC7984ERC20Wrapper contract which implements a confidential token wrapper. It uses an internal `_mint` function that

The vulnerability exists within the `Action` class where caption properties accept raw HTML by default without proper output encoding or

How the Mentioned CVE Works The vulnerability exists within the `gix_date::parse::TimeBuf` struct in the Rust `gix-date` crate. The `TimeBuf::as_str()` method

The vulnerability in badkeys arises from insufficient input sanitization when processing malformed data containing ASCII control characters such as vertical

This vulnerability exploits the nonce-based encoder selection logic in the Sliver C2 server. When an unauthenticated HTTP request contains a

This vulnerability exploits the Yii framework’s behavior attachment mechanism within Craft CMS. Attackers with administrator access can send crafted JSON

The vulnerability in CraftCMS arises from admin controllers explicitly permitting anonymous access to critical methods. In AppController.php, the $allowAnonymous property

This vulnerability, tracked in the GitHub Advisory Database, enables authenticated Remote Code Execution (RCE) in Craft CMS via Server-Side Template

The vulnerability exists within the `save__Asset` GraphQL mutation. The mutation accepts a `_file` input object containing a `url` parameter. When

The vulnerability exists in the node.js-specific builds of the jsPDF library (dist/jspdf.node.js and dist/jspdf.node.min.js). It stems from insufficient sanitization of

The vulnerability in Craft CMS involves an information disclosure issue due to unchecked asset relocation during user profile photo updates.

How CVE-2025-47907 Works The vulnerability exists in the `database/sql` package’s `(Rows).Scan` method. When a database query is executed concurrently and

The vulnerability exploits the EXT32 data type in the MessagePack serialization format. An attacker creates a small, syntactically valid .msgpack

How the mentioned CVE works This stored Cross-Site Scripting (XSS) vulnerability exists in the campaign and template management components. An

This Insecure Direct Object Reference (IDOR) vulnerability exists within the `reorder()` method of the `OrderController.php` controller. The function is accessible

How the mentioned CVE works: The vulnerability exists in customer profile update functionality. When a low-privileged user submits a crafted

The vulnerability is a Server-Side Template Injection (SSTI) in the Bagisto e-commerce platform, built on Laravel with the Blade templating

The vulnerability is a Server-Side Template Injection (SSTI) in the Bagisto e-commerce platform, specifically in the “type” parameter of the

How the mentioned CVE works: The vulnerability exists within the Ib platform’s installation module (Ibkul/Installer). The installation process defines API

The vulnerability is caused by missing authentication decorators in three FastAPI endpoints within monitor.py. The `dependencies=[Depends(get_current_active_user)]` parameter is absent from

The vulnerability is a reflected cross-site scripting (XSS) issue in go-httpbin version 2.17.1, caused by unrestricted client control over the

The vulnerability exists within the `MultipartFile.move()` method of the AdonisJS BodyParser. When handling file uploads, the method uses the client-supplied

The vulnerability in Apache StreamPipes involves improper privilege management within the user ID creation mechanism, allowing non-administrator users to escalate

The vulnerability operates as a side-channel information disclosure flaw within the `/api/v1/user` endpoint’s authentication logic. When an unauthenticated or incorrectly

The vulnerability in Feast version 0.53.0 involves insecure YAML deserialization in the Kubernetes materializer job. In the file feast/sdk/python/feast/infra/compute_engines/kubernetes/main.py, the

This vulnerability exists due to flawed authorization logic when the Temporal server configuration has `system.enableCrossNamespaceCommands` enabled (default state). The frontend

The SignalK appstore interface’s `/appstore/install/:name/:version` REST API endpoint allows admin users to install npm packages. While it validates the package

The vulnerability exists in the SignalK Server’s access request endpoint (/signalk/v1/access/requests). This endpoint accepts unauthenticated POST requests by design for

This vulnerability exists because the SignalK server’s authentication middleware, configured in src/tokensecurity.js, does not protect several sensitive API endpoints. The

How the Mentioned Vulnerability Works The vulnerability exploits two flaws in SignalK’s access request system. First, the administrative interface prominently

The vulnerability exploits two chained flaws. First, an unauthenticated attacker connects a WebSocket to the `/signalk/v1/stream` endpoint with ?serverevents=all. The

The vulnerability occurs in Temporal server when the configuration setting `frontend.enableExecuteMultiOperation` is enabled. This feature allows clients to execute multiple

The Trix editor, in versions prior to 2.1.16, is vulnerable to stored cross-site scripting (XSS) attacks through the data-trix-attachment attribute.

The vulnerability resides in the improper state management of the `shareables` list within the `cbor2` library’s CBORDecoder. When a decoder

The CVE-2023-38151 vulnerability in the Visual Studio Code Go extension arises from improper handling of untrusted projects when Restricted Mode

The vulnerability exists within the experimental MCP server feature (serverless mcp). The `list-projects` tool accepts a user-controlled `workspaceRoots` parameter. This

How the mentioned CVE works: The vulnerable application loads user-defined Python rules and configuration files from locations like ~/.config/theshit/. When

This vulnerability occurs due to insufficient cycle detection when parsing MVG (Magick Vector Graphics) files. When ImageMagick processes an MVG

The vulnerability occurs within the `SVGStartElement` function in ImageMagick’s SVG coder. When parsing a maliciously crafted SVG file containing a

The CVE-2025-008 vulnerability in RustFS stems from a static, hardcoded authentication token “rustfs rpc” used for gRPC service access. This

The qs library, a Node.js query string parser, includes an arrayLimit option designed to prevent denial-of-service by restricting array sizes

The vulnerability is a bypass of a previous fix for credential leakage in the Ruby URI gem. When the `+`

This vulnerability functions through the product file upload feature. An authenticated attacker can upload a specially crafted XML file. This

The vulnerability, CVE-2024-34070, is a classic Zip Slip attack vector within the PsiTransfer application. It originates in the archive creation

The vulnerability involves the injection of ANSI escape sequences into the terminal output of Composer commands. ANSI sequences are control

How the CVE Works: This vulnerability arises in NestJS applications utilizing the `@nestjs/platform-fastify` adapter when security middleware (e.g., for authentication)

The vulnerability occurs in server-side applications using the `axios-cache-interceptor` library to proxy requests to an upstream service. The flaw is

How the mentioned cve works: The vulnerability in Picklescan arises from its reliance on _operator.attrgetter, a built-in Python function, to

The vulnerability exploits a missing authentication check in the `SetupController.php` file’s `backup()` method. A default `.htaccess` rewrite rule makes the

How the CVE Works This vulnerability is a bypass of the Picklescan security scanner. Picklescan works by analyzing pickle files

The vulnerability in Picklescan arises from its failure to detect a malicious pickle file that leverages the `numpy.f2py.crackfortran._eval_length` function as

The vulnerability exploits the `picklescan` security scanner’s failure to detect the dangerous `_operator.methodcaller` function within malicious pickle payloads. Attackers craft

How the mentioned CVE works (around 20 lines): The vulnerability exploits a gap in the Picklescan security tool’s detection capabilities.

How the mentioned CVE works: The vulnerability stems from improper handling of user-supplied HTML entities in the display_name field during

The vulnerability resides in the `isPublicUrl` function which validates webhook URLs. It uses a blocklist of regex patterns to match

The vulnerability exists in actiontech sqle versions up to 4.2511.0 within the JWT Secret Handler component, specifically in an unknown

The vulnerability exploits the `numpy.f2py.crackfortran.myeval` function, which is used in NumPy for evaluating Python expressions from strings. In Python’s pickle

The vulnerability resides in the handling of compressed protocol messages. When a client sends a Zlib-compressed message, it includes a

This vulnerability exploits a gap in Picklescan’s default dangerous function blocklist. Picklescan is a security tool designed to scan pickle

This vulnerability is a bypass in the Picklescan security scanner where it fails to recognize the `ctypes` module as dangerous

This vulnerability exploits a gap in PickleScan’s security checks by utilizing the `pty.spawn` function, which is absent from its list

The vulnerability stems from unsafe code execution within the `numpy.f2py.crackfortran` module. Functions such as `getlincoef` and `_eval_length` use Python’s `eval()`

The vulnerability exploits an insufficient denylist within the Picklescanner security tool. The scanner is configured to block specific dangerous functions

The path traversal vulnerability in Croogo CMS 4.0.7 operates through the ‘edit-file’ parameter in certain application endpoints. Attackers can craft

This vulnerability is a DNS rebinding attack against the MCP Python SDK (mcp on PyPI). In versions before 1.23.0, HTTP-based

The vulnerability in Gitea prior to version 1.22.2 arises from improper propagation of token scopes within its internal package registry

The vulnerability in Gitea before version 1.21.2 stems from an access control bypass in the authentication middleware for private user

How the mentioned CVE works: In Gitea before version 1.20.1, a cross-site scripting vulnerability exists due to inadequate validation of

The vulnerability in libxmljs version 1.0.11 arises from improper handling of internal properties when parsing specially crafted XML documents. Specifically,

How the mentioned CVE works: The vulnerability in Gitea before version 1.22.2 enables Cross-Site Scripting (XSS) attacks via the search

The vulnerability in Gitea versions prior to 1.21.8 allows unauthorized disclosure of user login timestamps through the web interface. This

In Gitea before version 1.22.5, the system fails to properly enforce branch deletion permissions after merging a pull request. Normally,

The `reciprocal_mg10` function in the `ruint` crate is publicly marked as safe, implying it cannot trigger undefined behavior (UB). However,

This vulnerability in Gitea versions prior to 1.22.3 stems from improper authorization checks when processing API requests with tokens scoped

The vulnerability resides in the authorization logic for the `/repos/{owner}/{repo}/releases/{id}` API endpoint responsible for deleting releases. Gitea’s permission model is

This vulnerability exists in the Mattermost server’s handling of post action integrations, specifically the `/share-issue-publicly` slash command intended for the

The vulnerability exists in the integration between Mattermost and Jira. When an authenticated user requests to attach a Mattermost post

This vulnerability operates in self-hosted n8n instances where the Code node is configured to run in legacy JavaScript execution mode,

How the mentioned vulnerability works: The sandbox bypass vulnerability in n8n’s Python Code Node arises from the integration of Pyodide,

The vulnerability (CWE-502) exploits how `torch.load()` uses Python’s `pickle` module by default. When `weights_only=True` is not set, `pickle` reconstructs objects

The vulnerability exploits the “Respond to Webhook” node in n8n workflows. When configured to return HTML content, this node can

How the CVE Works The vulnerability existed in the `Serializable.toJSON()` method. When LangChain serializes objects (e.g., for storage or transmission),

How the Mentioned CVE Works: The vulnerability (GHSA-hm5p-x4rq-38w4) is a logic flaw in the HTTP client library `httparty` for Ruby.