Dhiyaneshgeek

An unauthenticated arbitrary file write issue exists in the 'aVideoEncoderChunk.json.php' endpoint. Remote attackers can use HTTP PUT requests to write up to 4 GB of arbitrary content to the server filesystem without authentication. This can lead to disk space exhaustion causing denial of service, poisoning of the video encoding pipeline, or remote code execution when combined with local file inclusion.

An issue exists during user registration where the software fails to sanitize the `phone` field. This allows unauthenticated attackers to perform a stored cross-site scripting attack by injecting malicious JavaScript that persists in the database. The script executes in the browser session of an administrator when they visit the users management page, as the unsanitized value is rendered using innerHTML.

pyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. The vulnerability exists in the download package functionality accessible via the `/api/addPackage` endpoint, where user-supplied URLs are passed to the download engine without validation. The affected code is located in `src/pyload/webui/app/blueprints/api blueprint.py`. The download engine in `src/pyload/core/managers/download.py` accepts any URL scheme and initiates HTTP requests to arbitrary destinations. Exploitation involves submitting a malicious URL, such as `http://169.254.169.254/metadata/v1.json`, to retrieve cloud metadata. This can lead to cloud metadata theft, lateral movement, credential exposure, and infrastructure mapping.

Chamilo LMS is a learning management system. A flaw exists in the H5P Import feature that allows authenticated users with the Teacher role to achieve Remote Code Execution (RCE). The system’s validation of H5P packages only confirms the presence of the `h5p.json` file, failing to block potentially harmful files like `.htaccess` or PHP files with alternative extensions. An attacker can upload a specially crafted H5P package containing a webshell and a `.htaccess` file. The `.htaccess` file enables PHP execution for `.txt` files, effectively bypassing security controls. The **API endpoint** involved is the H5P Import feature. The vulnerable component is the H5P package validation process, specifically the function that checks for the `h5p.json` file. The attacker manipulates the `h5p.json` file and associated files within the H5P package.

Glances, a system cross-platform monitoring tool, has an issue where the web server runs without authentication by default when started with `glances -w`. This exposes a REST API containing sensitive system information, including process command-lines that may contain credentials like passwords, API keys, and tokens, to any network client. The API endpoints, such as `/api/4/system` and `/api/4/all`, allow access to system information, process lists, network connections, filesystems, and Docker containers. The vulnerable code resides in files like `glances/outputs/glances restful api.py` and `glances/plugins/processlist/ init .py`. The `cmdline` parameter within the process list API (`/api/4/processlist`) exposes full command-line arguments without sanitization. This can lead to complete system reconnaissance and credential harvesting, potentially enabling lateral movement and targeted attacks.

Cloud CLI, a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI, contains a flaw due to OS Command Injection via WebSocket Shell. The `projectPath` and `initialCommand` parameters in the `server/index.js` file are directly incorporated into a bash command string without proper sanitization, allowing for arbitrary OS command execution. A further injection point exists through the unsanitized `sessionId`. This issue allows unauthenticated remote code execution on any instance running with the default configuration. The root cause is the insecure default JWT secret combined with a WebSocket authentication function that bypasses database user validation. The vulnerability allows full OS command execution, file system access, credential theft, and potential lateral movement within the network. The `projectPath` parameter is also susceptible to double-quote escape injection.

The changedetection.io application allows users to specify XPath expressions as content filters via the `include filters` field. These XPath expressions are processed using the elementpath library, which implements XPath 3.0/3.1 specifications. XPath 3.0 includes the `unparsed-text()` function, which can read arbitrary files from the filesystem. The application does not validate or sanitize XPath expressions to block dangerous functions, allowing an attacker to read any file accessible to the application process. The vulnerable code resides in the `html tools.py` file, specifically within the `xpath filter()` function (lines 187-220). The application's validation in `forms.py` only checks for syntactical validity of the XPath expression and does not prevent the use of dangerous functions like `unparsed-text()`. An attacker can exploit this by setting the `include filters` field to an XPath expression that utilizes `unparsed-text()` to read arbitrary files, such as `/etc/passwd`.