AISLE CVE Discoveries

SQL injection in the Patient REST API via the _sort parameter

Unauthenticated MedEx API token disclosure via the callback endpoint

Unauthenticated command injection via NetBIOS names in the WINS server hook script

Stored XSS via package metadata rendered unescaped in href attributes

Argument injection in the CONNECT engine's curl command line via the table HTTP attribute

Authentication bypass via NUL character in RSA-PSK usernames

Use-after-free in mod_ldap with per-directory configuration

Authentication bypass for ScriptAlias CGI scripts via a mod_auth/mod_cgi path mismatch

Allowlist bypass via spoofed actor.name display names in the Nextcloud Talk plugin

Exec allowlist bypass via command substitution inside double-quoted strings

Command injection via cmd.exe metacharacters in allowlist-gated exec requests

LDAP filter injection via unescaped usernames during authentication

Unauthenticated SQL injection in the /get/<package>/<version> endpoint

SQL injection in user::maintains() via role filters interpolated into an IN() clause

SQL injection in bug subscription deletion via a crafted email value

PHP code execution via preg_replace /e in bug update email handling

SQL injection in Damblan_Karma via unsafe literal substitution in an IN() list

SQL injection in category deletion via the category id

Use-after-free in HTTP/2 stream-dependency handling after curl_easy_reset()

Double free of the GSASL context during SASL authentication cleanup

Incorrect boundary conditions in the WebRTC audio/video component

Improper access control in the attachment storage move operation

Improper access control in the attachment migration routine

Use-after-free in the WebRTC signaling component

Stack buffer overwrite when processing oversized file handles in the SFTP server

Missing CSRF protection allows cross-site package uploads and admin actions

Inbound allowlist bypass in the voice-call extension via empty or suffix-matched caller IDs

Request smuggling via first-wins Content-Length parsing in inets httpd

Site-scoped capability check in nf_delete_all_data enables network-wide data deletion

Unauthenticated stored XSS via crafted Repeatable Fieldset submission indexes

Out-of-bounds read via integer underflow when reassembling zero-length DTLS fragments

Roadmap authorization bypass via an operator precedence bug in the role check

Password for another .netrc user sent when the URL specifies only a username

Stored XSS in the Graphical Pain Map (clickmap) encounter form

Out-of-bounds read and write in the ADX audio decoder via a mid-stream channel layout change

Double free in the NVDEC hardware decoder when no decoder surfaces remain

Stack buffer overflow in the Vulkan HEVC decoder via oversized vps_num_hrd_parameters

Heap buffer overflow in the VobSub subtitle demuxer via excessive distinct stream IDs

Missing Kerberos principal check in the gssapi-keyex path allows login as arbitrary users

Stack buffer overflow in libcasper via file descriptors exceeding FD_SETSIZE in select()

Missing authorization on get_claim_file.php lets any user download and delete claim files

Command injection in the update-clawtributors maintainer script via commit author emails

Insufficient permission checks allow non-admin users to run migration operations

SQL injection in the Immunization module via the patient_id parameter

SQL injection in logical replication via crafted table names at REFRESH PUBLICATION

Integer wraparound undersizes allocations, letting unprivileged users write out of bounds

Privilege escalation to administrator via unvalidated usergroup role assignments

Improper access control in the fixDuplicateLists admin repair method