Abraxas Labs

n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node

phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

SQLite CLI through 3.54.1 Command Injection via .recover Output

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal

Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery

phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql

Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()