Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page. CVSSv3.1 8.8 (HIGH)
NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbit CVSSv3.1 9.6 (CRITICAL)
GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation. CVSSv3.1 9.8 (CRITICAL)
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message. CVSSv3.1 8.4 (HIGH)
The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and submit the form to execute an arbitrary operating-system command as the account running PHP. CVSSv3.1 8.8 (HIGH)
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing to any file the web server process can write to, and the next scheduled job run will follow the symlink and overwrite the target file's content with the job ID CVSSv3.1 8.4 (HIGH)
Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserving unvalidated directory paths containing ../ sequences that are passed to unlink(), enabling deletion of files outside the intended media storage directory. CVSSv3.1 8.1 (HIGH)
Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without requiring equivalent permissions. CVSSv3.1 9.8 (CRITICAL)
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed. CVSSv3.1 9.8 (CRITICAL)
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served. CVSSv3.1 8.8 (HIGH)
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process. CVSSv3.1 8.1 (HIGH)
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions. CVSSv3.1 8.6 (HIGH)
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions. CVSSv3.1 9.8 (CRITICAL)
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions. CVSSv3.1 9.8 (CRITICAL)
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions. CVSSv3.1 9.8 (CRITICAL)
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. CVSSv3.1 9.8 (CRITICAL)
Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. CVSSv3.1 8.8 (HIGH)
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions. CVSSv3.1 8.8 (HIGH)
Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions. CVSSv3.1 9.9 (CRITICAL)
Unauthenticated SQL Injection in Boost <= 2.0.4 versions. CVSSv3.1 9.3 (CRITICAL)
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. CVSSv3.1 9.3 (CRITICAL)
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0. CVSSv3.1 8.1 (HIGH)
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link(). CVSSv3.1 8.1 (HIGH)
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c CVSSv3.1 9.8 (CRITICAL)
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accounting exports, causing financial data integrity loss. CVSSv3.1 8.1 (HIGH)