Khanmarshal

Grafana is an open-source platform for monitoring and observability. When an Elasticsearch data source is configured with a time-based index pattern, Grafana generated one index name for every interval in the requested query time range without any upper limit. A user with permission to query the data source, which includes users holding only the Viewer role in a default configuration, could submit a single small query with an extreme time range and cause the server to allocate memory until it was terminated. The allocation occurred before any request was sent to Elasticsearch, so the condition applied whether or not the Elasticsearch cluster was reachable. Data sources configured with a static index name are not affected.

An authenticated user with permissions to query a SQL data source can cause a denial of service by injecting the `timeGroup` macro through a WHERE clause. Because the regex-based macro parsing does not reject this injection, evaluating the macro leads to uncontrolled memory consumption, which can terminate the server process. This issue affects Microsoft SQL Server, PostgreSQL, and MySQL data sources.

The `callResource` handler in the Loki datasource plugin contains a path traversal flaw. This allows an authenticated user with a Viewer role to escape the resource sandbox and access administrative endpoints such as '/config', '/services', and '/ready'. This access can be used to extract internal service information and sensitive backend configurations.

A security issue exists in OpenCart related to the Single-Use Coupon Handler component. Manipulation of this component can lead to a race condition. The issue can be exploited remotely and is considered difficult to exploit. The exploit has been publicly released. The vendor was notified but did not respond.

A flaw exists in LearnHouse that allows for unrestricted file upload. The issue is located within the Course Thumbnail Handler component, specifically affecting an unknown function associated with the `/api/v1/courses/` endpoint. The `thumbnail` parameter is susceptible to manipulation, enabling remote attackers to upload files without restrictions. The exploit details have been publicly disclosed.

A cross site scripting issue exists in LearnHouse. The issue is located in the Account Setting Page component, specifically within the file '/dash/org/settings/previews', involving an unknown function. The attack can be launched remotely. The exploit has been publicly released. The vendor was notified but did not respond.

A flaw exists that results in improper control of resource identifiers. This issue is located within the Student Assignment Submission Handler component, specifically affecting an unknown function within the `/api/v1/assignments/{assignment id}/tasks/{task id}/sub file` file. The attack can be initiated remotely. The exploit for this issue has been publicly disclosed. The product utilizes continuous delivery with rolling releases, and no specific version details for affected or updated releases are available. The vendor was contacted regarding this disclosure but did not respond.

A flaw exists in LearnHouse related to the Image Handler component, leading to information disclosure. This issue can be exploited remotely. The exploit is publicly available. The vendor was informed of this issue but did not provide a response.

A weakness exists in givanz Vvveb that could allow for cross-site request forgery. The vulnerability affects unknown code and can be exploited remotely. The exploit has been publicly released.

A flaw exists within the Configuration File Handler component that can lead to information disclosure. The issue is potentially exploitable remotely. The exploit has been publicly disclosed.

A cross-site scripting issue exists in the SVG File Handler component. This manipulation can be launched remotely. The exploit is publicly available.

A security flaw exists in the Image Handler component of givanz Vvveb. Manipulation of this component can lead to information disclosure. Remote exploitation is possible, and the exploit has been publicly released.

A vulnerability exists in academico-sis related to the Profile Picture Handler component. The issue involves unrestricted upload via the `/edit-photo` file. This manipulation is possible to be carried out remotely. The exploit has been publicly disclosed. The product adopts a rolling release strategy to maintain continuous delivery.

A vulnerability exists in Selleo Mentingo 2025.08.27 within the Content-Type Handler component. Manipulation of the `userAvatar` argument results in unrestricted upload, and the attack can be performed remotely. The exploit is publicly available. The vendor was contacted regarding this disclosure but did not respond.

A security issue has been identified in Selleo Mentingo. The vulnerability resides in an unknown function within the Profile Picture Handler component. Manipulation of the `userAvatar` argument allows for unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed, and the vendor was notified but did not respond.

A cross-site scripting issue exists due to manipulation of the `Description` argument in the processing of the `/api/course/enroll-course` endpoint within the Create New Course Basic Settings component. The attack can be launched remotely.