CVE Catalog

A vulnerability exists in the EVbee Service App and the DC Quick Charger Firmware, prior to version 1.5.1, allowing sensitive information such as passwords and charging card UIDs to be logged insecurely. This issue has been addressed in the latest version of the EVbee Service App.

A vulnerability exists in the EVbee Service App versions prior to 1.4.710 and in the DC Quick Charger Firmware versions prior to V1.5.1. The issue arises because the firmware update mechanism lacks cryptographic signature validation. This flaw enables individuals with access to the firmware update feature to upload arbitrary files, potentially leading to unauthorized code execution.

A vulnerability has been identified in the webserver running on port 8090, which lacks authentication. This flaw allows for the unauthorized access and leakage of sensitive information, such as configured passwords, and enables file uploads through various endpoints. The issue affects the EVbee Service App prior to version 1.4.710 and DC Quick Charger Firmware prior to V1.5.1.

A command injection vulnerability has been identified in the network diagnosis endpoint of the web server running on port 8090. This issue affects the EVbee Service App versions prior to 1.4.710 and the DC Quick Charger Firmware versions prior to V1.5.1.

A vulnerability allowing an Adversary-in-the-Middle (AitM) attack has been identified in the EVbee Service Android app, specifically in versions prior to 1.4.710. The app uses TLS for encrypted communication with the EVbee server but fails to validate the server's certificate. This flaw enables an attacker to intercept and manipulate the communication between the app and the server. The encryption is weak, utilizing RC4 with a hardcoded key, which could allow an attacker to access sensitive information such as access codes to charging stations. This vulnerability affects the EVbee Service app version 1.4.101.00.

A vulnerability allowing improper authentication has been identified in waooAI waoowaoo versions through 0.4.1. The issue arises in the Internal Task Header Handler component, specifically within the getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight functions in src/lib/api-auth.ts. The vulnerability is triggered by manipulating the x-internal-user-id request header, which can lead to unauthorized user impersonation. This flaw can be exploited remotely, and a public exploit is available.

A stack-based buffer overflow vulnerability has been identified in Shibby Tomato firmware versions prior to 1.28.0000. This issue arises in the DNS list rendering function 'sub_407220' within the 'httpd' component, located at '/usr/sbin/httpd'. The vulnerability can be exploited remotely by manipulating the size of the DNS list being processed.

A vulnerability exists in PrestaShop version 8.2.1 due to improper sanitization of elements, specifically in the 'Update your address' function. The issue arises from insufficient validation of the 'Alias' parameter, enabling attackers to inject malicious expressions. These expressions are executed when the 'Get my data in CSV' tool is used, potentially leading to unauthorized access to the victim's personal data.

A remote code execution vulnerability has been identified in the Thales CERT 'Suspicious' application, versions through 1.3.4. This vulnerability allows an unauthenticated attacker to execute arbitrary code and overwrite writable application files, including Python modules, configuration files, cron inputs, and runtime artifacts. The issue leads to a persistent denial of service, potential compromise of application secrets or integrations, and root-level execution within the Django application container.

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. The issue arises because the application fails to properly validate whether a user assigned to an incoming webhook has the appropriate access to the designated team or channel. This flaw enables a requester with webhook management permissions to send posts or direct messages on behalf of another user by manipulating the incoming webhook configuration and payloads.

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2 and 11.6.x through 11.6.4, where the application fails to check if a guest account is deactivated before creating a session via the magic-link token login process. This oversight allows a deactivated guest user to gain a fully functional session using a magic-link token that was issued prior to the account's deactivation.

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. These versions fail to invalidate OAuth refresh tokens when a user account is deactivated. As a result, a deactivated user or an attacker with a valid refresh token can obtain new access tokens through the OAuth refresh token grant endpoint.

A denial-of-service vulnerability has been identified in Mattermost versions 11.7.x prior to 11.7.2, 11.6.x prior to 11.6.4, and 10.11.x prior to 10.11.19. The issue arises because these versions do not properly validate the length and content of message attachment field values. This flaw allows an authenticated attacker to disrupt service for all users in a channel by posting a message with a specially crafted payload that exploits catastrophic backtracking in the client-side markdown parser.

A Server-Side Request Forgery (SSRF) protection bypass vulnerability has been identified in the html_to_markdown expansion module of MISP misp-modules. This vulnerability arises because the module's IP address validation does not properly normalize IPv4-mapped IPv6 addresses before checking them against blocked ranges. As a result, an authenticated attacker can exploit this flaw by sending requests to loopback, private, link-local, or other restricted IP ranges, potentially accessing internal services or metadata. The vulnerability has been addressed by normalizing IPv4-mapped IPv6 addresses to their IPv4 equivalents before applying range checks, and by rejecting URLs without valid hostnames.

A vulnerability exists in the vllm-orchestrator-gateway component of Red Hat OpenShift AI. The issue arises because the production binary logs all incoming authorization headers and complete chat payloads, which may include personally identifiable information (PII) and secrets, to persistent logs. This sensitive information, such as bearer tokens and chat content, can be accessed by any user with logging privileges. The vulnerability leads to unauthorized information disclosure, potentially allowing an attacker to collect credentials and sensitive conversation details.

A command injection vulnerability has been identified in Shibby Tomato firmware versions prior to 1.28.0000. The issue resides in the CIFS mount handler, specifically within the 'sbin/rc' component, which is hardlinked to 'mount-cifs'. The vulnerability allows remote execution of arbitrary commands by manipulating the 'cifs1' or 'cifs2' NVRAM keys. The exploitation occurs after successfully mounting a CIFS share, where the unsanitized command from the NVRAM is executed as root via the 'system()' function.

A command injection vulnerability has been identified in the Shibby Tomato firmware versions up to 1.28.0000. The issue arises in the 'start_jffs2' function of the 'sbin/rc' component, where the NVRAM key 'jffs2_exec' is accessed without proper sanitization. This flaw allows remote exploitation, with injected commands executed as root during the JFFS2 initialization process. The vulnerability can be exploited by manipulating NVRAM values, a capability available through the web interface or other vulnerabilities.

A vulnerability allowing an out-of-bounds write has been identified in Shibby Tomato firmware versions through 1.28.0000. The issue resides in the apcupsd component, specifically within the CGI programs tomatodata.cgi, tomatoups.cgi, and multimon.cgi. The vulnerability is triggered by the main function's parsing of the multimon.conf configuration file, leading to stack corruption that could be exploited remotely. This vulnerability is publicly known and has an available exploit.

A critical Server-Side Template Injection (SSTI) vulnerability has been identified in the Centreon open tickets module. This vulnerability allows for Remote Code Execution (RCE) because the message_confirm field is stored without proper sanitization. The unsanitized input is rendered through Smarty without any security policy, enabling authenticated users to inject and execute arbitrary code on the server. The exploitation of this vulnerability could lead to the disclosure of environment secrets and impact the availability of the Centreon Infra Monitoring product.

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. The issue arises because the application fails to properly verify that the channel referenced in an action cookie corresponds to the channel of the target post. This flaw enables an authenticated user without access to a private channel to invoke interactive post actions on posts within that channel, using a cookie obtained from any accessible channel.

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. The issue arises in the shared channel inbound sync handler, where the application fails to properly verify post ownership. This flaw enables an authenticated remote cluster to alter or delete posts made by local users or other remote users. The exploitation is carried out by sending crafted sync messages that reference arbitrary post IDs in channels shared with the remote cluster.

A vulnerability exists in Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. The issue arises because these versions do not properly restrict the group_constrained channel flag to public and private channels that allow group synchronization. As a result, a regular member of a group or direct message can use the channel patch API to remove all participants from the conversation.

A vulnerability allowing unauthenticated users to delete arbitrary files has been identified in the Joomla extension Helix Ultimate, version 2.2.8. This issue arises from improper file handling, which could be exploited to remove files from the server.

A stored cross-site scripting vulnerability has been identified in the Joomla extension Helix Ultimate, specifically in version 2.2.8. This vulnerability allows for unauthenticated users to inject malicious scripts that are stored and executed in the context of the user.

A vulnerability exists in certain WAGO System I/O Field devices that allows unauthenticated remote access to internal system processes during a brief window in the early startup phase. This access, which is not documented and available only for a short time, can lead to a full system compromise by exploiting the internal diagnostic capabilities activated at startup.

A stack-based buffer overflow vulnerability has been identified in Shibby Tomato firmware versions through 1.28.0000. The issue resides in the apcupsd component, specifically within the CGI programs tomatodata.cgi, tomatoups.cgi, and multimon.cgi. The vulnerability is triggered by the getupsvar function, which improperly handles input from the apcupsd daemon, leading to a buffer overflow that can be exploited remotely.

A buffer overflow vulnerability has been identified in the Tenda CH22 router, specifically in version 1.0.0.1. The issue arises in the 'formCertListInfo' function within the '/goform/CertListInfo' file. This vulnerability can be exploited remotely, allowing attackers to manipulate the 'Name' argument and cause a buffer overflow.

A vulnerability exists in will-moss Isaiah versions through 1.36.9, specifically within the Websocket Connection Authentication component. The issue arises in an unknown function of the file app/main.go, where improper authentication is introduced. This vulnerability can be exploited remotely, allowing unauthorized access to authenticated application functions. As a result, it may expose sensitive Docker information and management capabilities, potentially leading to a significant administrative compromise.

A vulnerability allowing for missing authorization in the WebSocket master handler has been identified in will-moss Isaiah versions through 1.36.9. The issue arises in the 'Server.Handle' function within 'app/server/server/server.go'. By manipulating the 'Agent' argument, it is possible to bypass authorization checks, potentially leading to unauthorized access and actions on Docker resources managed by an Agent node. This vulnerability can be exploited remotely, especially when Agent authentication is disabled or weak.

A local file inclusion vulnerability has been identified in SourceCodester Online Book Store System version 1.0. The issue resides in the administrative interface, specifically within the file '/admin/index.php'. The vulnerability arises because the application improperly validates user-supplied input in the 'page' parameter, allowing remote attackers to manipulate file inclusion requests. Exploitation of this vulnerability enables the reading of arbitrary PHP source files from the application directory, with the potential to disclose sensitive server-side code.

A vulnerability allowing authorization bypass through user-controlled keys has been identified in Tuleap Enterprise Edition versions 17.0 to 17.5. This vulnerability could enable an attacker to access other users' data without proper authorization.

A critical vulnerability has been identified in SourceCodester Online Book Store System version 1.0, specifically within the Book Image Upload feature. The issue resides in an unknown function of the file '/admin/index.php?page=books', where the application fails to properly validate uploaded files. This lack of validation allows authenticated administrators to upload arbitrary files, including malicious PHP scripts, which can be executed on the server. The vulnerability can be exploited remotely, leading to unauthorized execution of commands on the server with the same privileges as the web server process.

A prototype pollution vulnerability has been identified in PrimeFaces PrimeReact versions through 10.9.8. The issue arises in the ObjectUtils.mutateFieldData function within the component API, where the 'field' argument can be manipulated to improperly modify object prototype attributes. This vulnerability can be exploited remotely and affects unsupported products.

A SQL injection vulnerability has been identified in the admin login page of SourceCodester Online Book Store System version 1.0. This flaw allows remote attackers to manipulate the Username input, bypass authentication, and gain unauthorized access to the administrative dashboard. The vulnerability arises from inadequate input sanitization, enabling attackers to alter SQL queries and evade credential verification.

A SQL injection vulnerability has been identified in the itsourcecode Hospital Management System version 1.0. The issue resides in the file '/patviewprescription.php', where the 'delid' parameter is not properly sanitized, allowing attackers to inject malicious SQL queries. This vulnerability can be exploited remotely, but requires authentication.

A SQL injection vulnerability has been identified in the Library Management System WordPress plugin, affecting versions prior to 3.5.8. The vulnerability arises because the plugin fails to properly sanitize and escape user-supplied parameters before incorporating them into SQL statements. This oversight allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to the extraction of sensitive data from the database, including user password hashes.

A vulnerability exists in the WP Job Portal WordPress plugin in versions prior to 2.5.5. The issue arises from the plugin's failure to verify ownership when returning an employer's contact email for a specific job. This flaw allows authenticated users with subscriber-level accounts to access other employers' private email addresses by enumerating job identifiers. The vulnerability is classified as an Insecure Direct Object Reference (IDOR), enabling cross-account email disclosure.

A vulnerability exists in the WP Job Portal WordPress plugin in versions prior to 2.5.5. The plugin fails to implement proper capability or ownership checks for job moderation actions. This oversight allows authenticated users with subscriber-level accounts to approve, feature, or reject jobs arbitrarily, including those belonging to other users.

A vulnerability exists in the Tutor LMS WordPress plugin in versions prior to 3.9.13, specifically within the Droip and Kirki page-builder integrations. The plugin fails to apply the necessary checks for enrollment, purchase, and private-course capabilities that are enforced in its main course management system. As a result, authenticated users with subscriber-level access can unauthorizedly enroll in paid or private courses, access private course materials, and mark any course as completed, but only on sites where the Droip or Kirki integration is active.

A vulnerability exists in the Tutor LMS WordPress plugin in versions prior to 3.9.13. The issue arises because the plugin does not properly verify if a user has the right to edit a specific post before overwriting it in one of its content-builder save handlers. Instead, it only checks against an unrelated identifier. This flaw allows authenticated users with instructor-level access to overwrite and take control of any post or page on the site, including those owned by administrators.

A vulnerability exists in the Tutor LMS WordPress plugin in versions prior to 3.9.13, where the plugin fails to implement proper authorization or validation before allowing comments to be created. This flaw enables authenticated users with subscriber-level access and above to post comments that are automatically approved, including arbitrary HTML and links, on any content site-wide. The vulnerability bypasses the standard comment moderation process.

A vulnerability exists in the Tutor LMS WordPress plugin in versions prior to 3.9.13, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts. The plugin fails to verify ownership of quiz attempts before writing to them, enabling users to overwrite recorded marks and pass/fail results. This issue arises from an Insecure Direct Object Reference (IDOR) vulnerability, where the ownership check can be bypassed by manipulating the request data.

A vulnerability exists in the Database for Contact Form 7, WPforms, and Elementor Forms WordPress plugin versions prior to 1.5.2. The issue arises because the plugin does not properly restrict PHP classes during the unserialization of user-supplied form-field values. This flaw allows unauthenticated users to inject arbitrary PHP objects, which are then instantiated when an administrator views the corresponding entry. This vulnerability represents an incomplete fix for CVE-2025-7384 and CVE-2026-2599, as the entry-editor file-field path was overlooked.

An authentication bypass vulnerability has been identified in the User Registration & Membership WordPress plugin, affecting versions prior to 5.2.2. The vulnerability arises because the plugin does not verify the authenticity of webhook notifications from payment providers before processing them. This flaw allows unauthenticated attackers to fake a payment-approved event, thereby activating a paid membership subscription without actual payment. The issue is particularly relevant for subscriptions paid through PayPal, as the vulnerability exploits the plugin's webhook integration with this payment provider.

A vulnerability exists in the User Registration & Membership WordPress plugin in versions prior to 5.2.2. The issue arises because the plugin does not implement proper authorization checks on membership upgrade actions. Instead, it allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier by supplying a specific identifier. This is possible because the plugin relies on user-supplied data to determine which user to modify, rather than using the currently logged-in user.

A stored cross-site scripting vulnerability has been identified in the Breeze Cache WordPress plugin, affecting versions prior to 2.5.6. The issue arises from a predictable replacement hash used in the HTML minification process, which can be exploited by injecting arbitrary HTML attributes that are then executed in the final output.

A vulnerability in AkariAsai Self-RAG versions up to commit 1fcdc420e48f50a7d7ab1ece5494221b93252e99 allows for arbitrary code execution through unsafe deserialization of index metadata. The issue arises in the retrieval_lm component, specifically within the Indexer.deserialize_from function in index.py. The vulnerability can be exploited remotely by manipulating the index_meta.faiss argument, leading to unauthorized code execution.

A code injection vulnerability has been identified in DedeCMS version 5.7.118, specifically within the Column Management feature. The issue arises in an unknown function of the file '/plus/search.php', where manipulation of the 'Column Name' argument allows for remote code execution. The vulnerability has been publicly disclosed and could be exploited by attackers.

A stored cross-site scripting vulnerability has been identified in SourceCodester Online Book Store System version 1.0, specifically within the User Management Module. This issue arises from improper handling of the Name/Username input, allowing authenticated users to inject malicious JavaScript that is permanently stored and executed when the page is accessed by other users. The vulnerability could be exploited remotely, with the injected scripts running in the context of the user’s session.

A vulnerability exists in yashbhalgat HashNeRF-pytorch versions up to commit 82885e698295982504eb6a26d060a6b2473e3706. The issue arises in the Checkpoint File Handler component, specifically within the run_nerf.py file, where the torch.load function is used to load checkpoint files. This deserialization process can be exploited locally by manipulating the ckpt_path argument, potentially leading to arbitrary code execution.