Vulnérabilités récentes · Page n° 119

InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods in the Guest Quotes controller, `application/modules/guest/controllers/Quotes.php`, call `approve_quote_by_id($quote_id)` and `reject_quote_by_id($quote_id)` directly without the `where_in('ip_quotes.client_id', $this->user_clients)` scoping that sibling methods use. A guest user assigned to one client can change another client's quote status by supplying sequential integer `quote_id` v

Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` i

maotoumao MusicFreeDesktop Request Forwarder server-side request forgery

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.

AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` filter lists, and the `Login::canUpload()` capability needed to submit a queue entry can be self-granted using an attacker-controlled login site without legitimate encoder credentials. `view/index.php` loads `queue.json` from `view/queue.json.php` into the `#grid` jQuery Bootgrid table; its title formatter concatenates `row.title` into raw cell HTML. An attacker can therefore store an HTM

AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. The supplied `siteURL` must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set `canUpload` or `isAdmin` to reach `Streamer::createIfNotE

OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in `SettingsUI` (`manageProfessional`) accepts administrator-controlled license key input that is reconstructed into a PHP `define()` statement in `config.php` without safe escaping. Because the application includes `config.php`, crafted input can alter the file's PHP syntax and cause persistent arbitrary PHP execution with the web server process privileges. An authenticated administrator must have Settings module access and permission to update Professional Li

AVideo-Encoder: missing authentication on control and status endpoints

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `view/queue.json.php` calls `Encoder::getAll(true)`, reveals streamer URLs through `getSiteURL()`, and triggers processing with `execRun()`. `view/status.php` returns `Access-Control-Allow-Origin` with a wildcard, reads the queue, triggers processing, and exposes host memory statistics through `ServerMonitor::getMemory()` when `serverStatus` is set. `view/listFiles.json.php` checks only `Login::canBul

The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

• Mettez à jour vers 100.20.0

AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after only `FILTER_VALIDATE_URL` syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. `Login::isLogged` reauthenticates using the attacker-settable `encoder_aVideoURL` cookie together with arbitrary nonempty `encoder_user` and `encoder_pass` cookies, and `Login::run` stores the raw fetched body in `result`. The unauthenticated `objects/login.json.php` endpoint returns that session object, enabling full-response e

AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/Streamer.php` and reaches navigation and form attributes; it also enters a single-quoted JavaScript string in `view/index.header.php`. It is not filtered by `objects/security.php`, while the `user` and `pass` fields are filtered only for single quotes, leaving double quotes and angle brackets capable of breaking out of their HTML attributes. In addition, `view/index.header.php` reflects P

a2ui Image Player/Video Player/Audio Player Image.js input validation

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses request-controlled `period`, `startDate` and `endDate` parameters without sufficient validation or escaping. The vulnerable code is in `modules/home/dataGrids.php` and `modules/activity/dataGrids.php`. The `startDate` and `endDate` values are inserted into SQL string comparisons without safe escaping, and `period` can directly influence generated SQL. An authenticated user with access to the affected DataGrid endpo

AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an HTTP service reachable by the encoder can self-grant `isLogged` and `canStream` without legitimate credentials. The endpoint requires only nonempty `playlists_id` and `APISecret` values; `APISecret` is forwarded rather than checked against a stored secret. This path never calls `Streamer::isURLAllowed` and therefore works regardless of the ope

AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php

Blombooru: administrator image-proxy server-side request forgery

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it server-side without meaningful destination validation. `proxy_image()` in `backend/app/routes/booru_import.py` only checks whether the value starts with http, then uses `get_client_for_url` or `requests.get` and streams the response. Private, loopback and link-local addresses are not blocked, and automatically followed redirects can move a request from a trusted domain to an internal address

Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742

• Mettez à jour vers 11.7.11
• Mettez à jour vers 11.8.6
• Mettez à jour vers 11.9.2

AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `too

Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes.

• Mettez à jour vers 2.4.4

Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags such as author_meta:user_pass, author_meta:user_email, or cf_coupon_amount to leak post meta and the post author's user record, including the password hash, without authentication.

• Mettez à jour vers 2.4.4