漏洞公告

phpMyFAQ: Path Traversal in Client::deleteClientFolder enables arbitrary directory deletion by non-super-admin admins

phpMyFAQ has unauthenticated FAQ permission bypass via getFaqBySolutionId fallback query

phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields

phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed

phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ

phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering

phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

phpMyFAQ has Stored XSS in FAQ Question/Answer via Encode-Decode Bypass of removeAttributes() Sanitization

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

phpMyFAQ's Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering

Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header

Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header

Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain

Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

wger: trainer_login open redirect - ?next= parameter not validated against host

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

wger: CSV/TSV formula injection in gym member export (first_name/last_name)

GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering