vendor_project: Fortinet

vulnerability_name: Fortinet FortiWeb SQL Injection Vulnerability

author: Codex

content_markdown:
CVE-2025-25257 is a critical SQL-injection vulnerability in the FortiWeb
administrative GUI. Fortinet states that an unauthenticated attacker can send
crafted HTTP or HTTPS requests to execute unauthorized SQL code or commands.
Fortinet observed exploitation in the wild, and CISA added the vulnerability
to its Known Exploited Vulnerabilities (KEV) catalog on 2025-07-18.

The durable remediation is to move every affected FortiWeb appliance and HA
peer to a vendor-supported release at or above the fixed threshold for its
release branch. Fortinet's documented workaround is to disable the HTTP/HTTPS
administrative interface while an upgrade is pending. That workaround affects
management access and requires the appliance owner; it is not permission for a
repository agent to change a live device.

## Evidence basis and limits

I reviewed Fortinet PSIRT advisory FG-IR-25-151, Fortinet's FortiWeb CLI
documentation, the CISA KEV feed, the CVE record, and the NVD record on
2026-07-22. I did not access a FortiWeb appliance, inspect private firmware
source, send a crafted request, or validate a customer deployment. The version,
impact, workaround, and exploitation statements in this recipe are therefore
official advisory facts, not observations from a live target.

The current official interfaces agree that the issue is critical, although
the displayed CVSS value has varied between official records. This recipe does
not depend on a particular score: the unauthenticated attack path, KEV status,
and exact vendor version matrix establish the remediation priority. Re-check
FG-IR-25-151 before approving a change because Fortinet can revise product or
upgrade guidance.

## When to use this recipe

Use it when a scanner, inventory, ticket, repository, or operator identifies a
FortiWeb appliance that may run one of the affected 7.0, 7.2, 7.4, or 7.6
releases. The repository may own firmware targets, VM image references,
FortiWeb Manager jobs, infrastructure definitions, inventory policy, upgrade
runbooks, monitoring checks, or vulnerability exceptions.

Do not use this recipe to probe an administrative listener, reproduce SQL
injection, copy an exploit, or make an unapproved firmware or interface change.
Repository authority is not authority over a FortiWeb appliance. When the
repository does not own the live device or its change path, produce a bounded
triage and operator handoff.

## Inputs

- A redacted inventory of every potentially affected appliance and HA peer:
  owner, environment, model or VM form factor, deployed firmware version,
  build, HA role, and evidence timestamp.
- Approved read-only version evidence from `get system status`, FortiWeb
  Manager, an authenticated asset inventory, or an operator-provided export.
- Administrative-interface evidence: whether HTTP and/or HTTPS management is
  enabled, listening interfaces, approved source networks, intervening access
  controls, and whether an untrusted network can reach the listener.
- Repository-controlled firmware/image references, deployment definitions,
  FortiWeb Manager jobs, runbooks, policy checks, generated artifacts, and
  vulnerability exceptions.
- The vendor-supported target release and upgrade path for each hardware/VM
  model, plus compatibility, storage, HA sequencing, maintenance-window,
  backup, health-check, and rollback evidence.
- Approved security evidence for the exposure window: relevant administrative
  and system logs, alerts, configuration-change records, incident owner, and
  Fortinet support status.

Do not commit appliance credentials, serial numbers, certificates, license
files, full configuration exports, support bundles, raw logs, topology, or
customer data. Preserve sensitive evidence only in an approved operational or
incident-response system.

## Affected and fixed versions

Fortinet publishes this exact version matrix:

| FortiWeb branch | Affected releases | First fixed threshold |
| --- | --- | --- |
| 7.6 | `7.6.0` through `7.6.3`, inclusive | `7.6.4` or later |
| 7.4 | `7.4.0` through `7.4.7`, inclusive | `7.4.8` or later |
| 7.2 | `7.2.0` through `7.2.10`, inclusive | `7.2.11` or later |
| 7.0 | `7.0.0` through `7.0.10`, inclusive | `7.0.11` or later |
| 6.4 | Not affected according to FG-IR-25-151 | No CVE-specific upgrade required |

Use a currently supported, vendor-approved target compatible with the exact
appliance rather than treating an old minimum fixed release as a preferred
long-term pin. Do not downgrade to 6.4 as a workaround. For any branch or model
not represented in the table, consult the current Fortinet advisory and
support guidance rather than inferring status.

Version evidence must cover every HA member, replacement image, disaster-
recovery appliance, and generated deployment artifact. A fixed active peer is
not evidence that its standby peer or next replacement instance is fixed.

## How to determine exposure safely

Fortinet documents `get system status` as a read-only command that reports the
firmware version, build, and HA information:

```text
get system status
```

Run it only through an approved administrative channel, and redact serial
numbers or other device identifiers before attaching evidence to a review.
Then classify each target independently:

1. Confirm that the product is FortiWeb and record the exact release/build for
   every appliance or HA member.
2. Compare that release with the vendor matrix above. Desired-state files or
   a scanner string alone do not prove the deployed version.
3. Establish whether the HTTP or HTTPS administrative interface is enabled and
   which interfaces and source networks can reach it.
4. Trace the effective management path using approved configuration,
   firewall, load-balancer, VPN, and inventory evidence. An internal listener
   has reduced reachability, but it is not automatically unreachable to an
   attacker who has a foothold on that network.
5. Record the exposure window and whether existing logs or alerts indicate
   suspicious administrative requests, database activity, configuration
   changes, unexpected accounts, or other compromise concerns.

Do not send a crafted HTTP/HTTPS request, SQL fragment, path, callback, or
other active probe. The deployed version and management-interface evidence are
sufficient to decide that remediation is required.

## Incident-response gate

Because Fortinet observed exploitation and CISA classifies this CVE as known
exploited, resolve the incident-response question before routine patching:

- If approved evidence suggests attempted exploitation or compromise, stop the
  patch-only workflow. Preserve relevant logs and configuration evidence,
  notify the incident owner, and engage Fortinet support through the approved
  channel.
- Do not reboot, erase logs, rotate credentials, remove accounts, or clean
  artifacts until the incident owner decides what evidence must be retained.
- Do not conclude that an appliance is clean because a single indicator or
  alert is absent.
- A fixed firmware release closes the vulnerable entry point; it does not by
  itself establish the trustworthiness of an appliance that may already have
  been compromised.

This gate is conservative incident handling derived from the confirmed
in-the-wild exploitation status. FG-IR-25-151 does not publish a complete
forensic checklist for every deployment.

## Temporary containment

Fortinet's documented workaround is to disable the HTTP/HTTPS administrative
interface. Treat that as a temporary, owner-approved containment while the
fixed firmware is being prepared, not as permanent remediation.

Before applying it, document the alternate management path, availability and
support impact, HA implications, approving owner, exact scope, validation,
expiry, and restoration plan. Do not disable the only safe management path or
lock operators out of an appliance. If the repository cannot prove that the
workaround is safely applicable, record it as an operator decision in
`TRIAGE.md`; do not invent a FortiWeb CLI change.

Network isolation or source restriction can be considered as defense in depth
by the responsible network owner, but it is not the workaround named in
FG-IR-25-151 and it does not make affected firmware fixed.

## How to remediate CVE-2025-25257

1. Inventory every affected appliance, HA peer, VM image, and recovery artifact
   before selecting a target release.
2. Resolve the incident-response gate. When compromise is suspected, preserve
   evidence and follow the incident owner's recovery decision before an
   ordinary upgrade.
3. Select a currently supported Fortinet release at or above the correct
   branch threshold. Validate the model-specific upgrade path and each required
   hop against current Fortinet documentation and support guidance.
4. Back up configuration and other required recovery data through the existing
   approved process. Keep sensitive backup artifacts outside Git, and confirm
   that the recovery owner can use them.
5. Update every repository-controlled firmware target, VM image reference,
   FortiWeb Manager job, inventory rule, runbook, policy check, and generated
   artifact consistently. Do not leave a standby or replacement path pinned to
   an affected build.
6. Document the human operator's HA sequence, expected management and traffic
   impact, stabilization checks, maintenance window, and rollback decision.
   The agent must not execute an appliance upgrade unless the task explicitly
   grants that exact live-device authority.
7. Remove temporary containment only after an authorized operator verifies the
   fixed release on every target and confirms that the approved management
   exposure is restored as intended.

## How to verify remediation

- Re-run the read-only `get system status` check on every appliance and HA peer
  and compare the deployed release/build with the applicable fixed threshold.
- Confirm the running artifact, not only the desired-state pin, inventory
  target, or uploaded firmware image.
- Confirm all repository-controlled images, jobs, generated outputs, and
  recovery definitions resolve to the reviewed fixed target.
- Run the existing non-adversarial FortiWeb health checks for normal proxy/WAF
  traffic, administrative access, monitoring, logging, HA state, and failover
  readiness. Do not use a SQL-injection or crafted-request test.
- Confirm temporary interface containment was either retained with an owner
  and expiry or removed through the approved plan after fixed-version evidence
  was collected.
- Record target, HA role, before/after release, build, evidence timestamp,
  verifier, health-check results, and unresolved incident-response actions.

Do not suppress the finding until every controlled target and reinstall path
has fixed-version evidence. Do not call the appliance uncompromised based only
on a successful upgrade and ordinary health checks.

## Rollback and stop conditions

Prefer forward recovery to another vendor-supported fixed release. If an
operational regression requires restoring a prior artifact, the rollback may
restore vulnerable firmware. Reapply the approved HTTP/HTTPS administrative-
interface containment before returning that appliance to its former exposure,
retain an incident and upgrade owner, and set a time-bounded path back to fixed
firmware.

Stop and write `TRIAGE.md` when:

- product identity, live release/build, HA membership, or administrative-
  interface reachability cannot be proved;
- the repository does not own the appliance, image, deployment definition, or
  upgrade runbook needed for remediation;
- suspicious activity creates an evidence-preservation or incident-response
  decision;
- a vendor-supported target, model-specific upgrade path, required intermediate
  hop, compatibility, storage requirement, backup, HA sequence, maintenance
  window, or rollback cannot be validated;
- disabling HTTP/HTTPS administration would remove the only approved
  management path or requires authority not granted by the task;
- remediation requires a live upgrade, reboot, failover, interface change,
  credential rotation, or outage outside the authorized boundary; or
- meaningful verification would require a crafted request, active probing,
  sensitive-data access, or a destructive test.

`TRIAGE.md` must name CVE-2025-25257, the inspected files and evidence, redacted
target and owner, observed and required release, HA state, management-interface
reachability, temporary containment, compromise concern, authority or
compatibility blocker, next responsible human, and safest next action.

## The prompt

~~~markdown
You are remediating CVE-2025-25257, a critical, known-exploited SQL-injection
vulnerability in the FortiWeb HTTP/HTTPS administrative GUI.

Return exactly one output:

- a reviewer-ready change set that updates every repository-controlled
  FortiWeb target to a vendor-supported fixed release and documents safe
  operator verification, containment, incident handling, and rollback; or
- `TRIAGE.md` when ownership, deployed state, evidence preservation, upgrade
  safety, live-device authority, or verification cannot be resolved here.

### Guardrails

- Scope only CVE-2025-25257 and directly related FortiWeb inventory, firmware
  targets, administrative-interface exposure, containment, upgrade artifacts,
  safe verification, and incident-response handoff.
- Do not connect to, scan, probe, or mutate a live FortiWeb appliance unless
  the task explicitly grants that exact authority.
- Do not generate, copy, or send a SQL-injection payload, crafted HTTP/HTTPS
  request, exploit path, callback, file, or proof-of-concept.
- Do not treat a desired-state pin or scanner string as deployed-version proof.
- Do not store credentials, serial numbers, certificates, license files, full
  configurations, support bundles, raw logs, topology, or customer data in Git.
- Do not reboot, fail over, upgrade, disable an interface, rotate credentials,
  or remove suspected artifacts automatically.
- Do not describe a fixed release as proof that prior compromise did not occur.

### Steps

1. Inventory repository-owned FortiWeb firmware/image targets, VM definitions,
   FortiWeb Manager jobs, HA/recovery definitions, runbooks, policy checks,
   generated artifacts, and vulnerability exceptions. Record files inspected.
2. Build a redacted target matrix with product/model, owner, environment,
   deployed version/build and evidence date, HA role, HTTP/HTTPS administrative
   state, effective reachability, desired fixed release, and repository control
   point. Use approved evidence; do not query a live device without authority.
3. Compare each target with the exact fixed thresholds:
   - 7.6.0-7.6.3 -> 7.6.4 or later
   - 7.4.0-7.4.7 -> 7.4.8 or later
   - 7.2.0-7.2.10 -> 7.2.11 or later
   - 7.0.0-7.0.10 -> 7.0.11 or later
   Fortinet lists 6.4 as not affected. Do not infer the status of another
   release or downgrade to 6.4.
4. Resolve the incident-response gate using only approved, already-available
   evidence. If suspicious activity exists, stop routine patch work, preserve
   evidence, and name the incident owner and Fortinet support handoff.
5. For repository-controlled targets without an incident stop, update all
   firmware/image references, jobs, policies, runbooks, generated artifacts,
   HA peers, and recovery definitions to a currently supported release at or
   above the applicable threshold.
6. If rollout cannot be immediate, document Fortinet's workaround to disable
   the HTTP/HTTPS administrative interface as a human-owned, time-bounded
   containment. Do not execute it or invent a CLI command.
7. Add or update static policy checks that fail when a controlled target, HA
   peer, generated artifact, or reinstall path remains below its threshold, or
   when an exception lacks owner, expiry, evidence, and fixed target.
8. Run only repository schema, formatting, rendering, and policy tests plus
   existing normal service health checks. Verification must never exercise the
   SQL-injection path.
9. Document operator-only actions: upgrade path/hops, backup, HA sequencing,
   maintenance impact, read-only `get system status` verification, normal
   health checks, temporary-containment removal, and rollback.

### Stop conditions

Stop with `TRIAGE.md` if ownership or live state is unknown; compromise is
possible; the fixed target or upgrade path is unvalidated; temporary
containment would remove safe management; a live change exceeds authority; or
verification would require exploit-like traffic, sensitive evidence, or a
destructive test.

The output must distinguish repository evidence, operator-supplied evidence,
and unverified live state. It must not claim a device was patched, protected,
or clean without authorized execution evidence.
~~~

## Output contract

Return one of:

- A reviewer-ready PR/change request that inventories every controlled target,
  updates all firmware/image/job/policy references to an approved fixed
  release, covers HA and recovery artifacts, documents temporary containment,
  supplies safe tests, and records human-owned upgrade, verification, rollback,
  and incident-response actions.
- `TRIAGE.md` containing the bounded evidence, owner, observed and required
  release, HA state, administrative-interface reachability, containment,
  compromise concern, authority or compatibility blocker, and next action.

The output must state what was verified from repository artifacts, what came
from an operator, and what remains unverified. It must not contain exploit
material or claim that a live appliance is fixed or trustworthy without
approved execution evidence.

## Primary references

- [Fortinet PSIRT advisory FG-IR-25-151](https://fortiguard.fortinet.com/psirt/FG-IR-25-151)
- [Fortinet FortiWeb `get system status` CLI reference](https://docs.fortinet.com/document/fortiweb/7.6.1/cli-reference/680825/system-status)
- [CISA Known Exploited Vulnerabilities catalog entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257)
- [CISA KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE Program record for CVE-2025-25257](https://www.cve.org/CVERecord?id=CVE-2025-25257)
- [NVD record for CVE-2025-25257](https://nvd.nist.gov/vuln/detail/CVE-2025-25257)

## Related recipes

- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})
- [Vulnerable Dependency Remediation]({{< relref "/security-remediation/vulnerable-dependencies" >}})
- [How to remediate vulnerabilities with AI agents]({{< relref "/security-remediation" >}})

description: Critical FortiWeb SQL injection exploited in the wild. Identify affected 7.0-7.6 appliances, upgrade to a Fortinet-fixed release, and verify without probing.

maturity: stable

title: CVE-2025-25257: FortiWeb unauthenticated SQL injection

quality: curated

recipe_kind: markdown-override

summary: An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.


default_status: unaffected

vendor: WAGO

status: affected

version_type: semver

archetype: generic

ecosystem: java/maven

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Deferred

summary: An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.


ecosystem: software/application

summary: A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.


default_status: unknown

product: Tecnomatix Plant Simulation V2302

vendor: Siemens

version_type: custom

product: Tecnomatix Plant Simulation V2404

severity: high

metric_type: Primary

part: a

vendor: siemens

status: Analyzed

summary: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict access to the file deletion functionality. This could allow an unauthorized attacker to delete files even when access to the system should be prohibited, resulting in potential data loss or unauthorized modification of system files.

title: Siemens Tecnomatix Plant Simulation security vulnerability


summary: A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0010). The affected application does not properly restrict the scope of files accessible to the simulation model. This could allow an unauthorized attacker to compromise the confidentiality of the system.


product: CHARX SEC-3150

vendor: Phoenix Contact

product: CHARX SEC-3100

product: CHARX SEC-3050

product: CHARX SEC-3000

ecosystem: operating-system

part: o

vendor: phoenixcontact

summary: An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

title: Phoenixcontact Charx Sec-3000 Firmware security vulnerability


summary: An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.


severity: critical

summary: An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.


summary: An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.


product: Intel(R) 700 Series Ethernet

version: before version 2.28.5

ecosystem: linux/kernel

summary: Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access.

title: Intel(R) 700 Series Ethernet security vulnerability


product: Mattermost

vendor: Mattermost

status: unaffected

vendor: mattermost

summary: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.

title: Mattermost Mattermost Server security vulnerability


product: Cloud portal

vendor: Growatt

vendor: growatt

summary: An unauthenticated attacker can hijack other users' devices and potentially control them.


product: OpenHarmony

vendor: OpenHarmony

product: openharmony

vendor: openatom

summary: in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible type. This vulnerability can be exploited only in restricted scenarios.

title: Openatom Openharmony security vulnerability


summary: in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.


summary: Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.


product: FutureNet AS-250/S

vendor: Century Systems Co., Ltd.

version: firmware Version 1.14.0 and earlier

product: FutureNet AS-250/F-SC

product: FutureNet AS-250/F-KO

product: FutureNet AS-250/NL

product: FutureNet AS-250/KL

product: FutureNet AS-250/KL Rev2

version: firmware Version 2.6.6 and earlier

product: FutureNet AS-250/L

product: FutureNet AS-M250/L

version: firmware Version 3.0.0 and earlier

product: FutureNet AS-M250/KL

product: FutureNet AS-M250/NL

product: FutureNet AS-P250/NL

product: FutureNet AS-P250/KL

summary: Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by Century Systems Co., Ltd. If this vulnerability is exploited, a remote unauthenticated attacker may reboot the device by sending a specially crafted request.

title: Century Systems Co., Ltd. Futurenet As-250/S security vulnerability


product: Mojave Inverter

vendor: Outback Power

version: All versions

vendor: outbackpower

summary: An attacker may modify the URL to discover sensitive information about the target network.


product: ragflow

vendor: infiniflow

summary: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability that may lead to unauthorized cross-tenant access (list tenant user accounts, add user account into other tenant). Unauthorized cross-tenant access: list user from other tenant (e.g., via GET /<tenant_id>/user/list), add user account to other tenant (POST /<tenant_id>/user). This issue has not yet been patched. Users are advised to reach out to the project maintainers to coordinate a fix.


product: parse-duration

vendor: jkroso

ecosystem: javascript/npm

summary: parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively, and an out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters. Version 2.1.3 contains a patch.


product: ZOO-Project

vendor: ZOO-Project

version: Commits before 5f155a8

summary: The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's WPS (Web Processing Service) implementation allows unauthorized access to files outside the intended directory through path traversal. Specifically, the Gdal_Translate service, when processing VRT (Virtual Format) files, does not properly validate file paths referenced in the VRTRasterBand element, allowing attackers to read arbitrary files on the system. The vulnerability exists because the service doesn't properly sanitize the SourceFilename parameter in VRT files, allowing relative path traversal sequences (../). When combined with VRT's raw data handling capabilities, this allows reading arbitrary files as raw binary data and converting them to TIFF format, effectively exposing their contents. This vulnerability is particularly severe because it allows attackers to read sensitive system files, potentially exposing configuration data, credentials, or other confidential information stored on the server.


vendor: octokit

summary: @octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.


product: Crayfish

vendor: Islandora

summary: Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.


product: mediawiki-skins-Lakeus

summary: Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with `(editinterface)` rights can edit system messages that are improperly handled in order to send raw HTML. In the case of `lakeus-footermessage`, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch.


summary: @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.


summary: @octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.


summary: @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.


product: ruby-saml

vendor: SAML-Toolkits

vendor: omniauth

vendor: onelogin

product: storagegrid

vendor: netapp

status: Modified

summary: ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.


summary: ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 contain a patch for the issue.


summary: ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.


product: gateway

vendor: envoyproxy

summary: Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to the access log. This vulnerability is fixed in 1.3.1 and 1.2.7. One can overwrite the old text based default format with JSON formatter by modifying the "EnvoyProxy.spec.telemetry.accessLog" setting.


product: label-studio

vendor: HumanSignal

ecosystem: python/pypi

summary: Label Studio is an open source data labeling tool. A path traversal vulnerability in Label Studio SDK versions prior to 1.0.10 allows unauthorized file access outside the intended directory structure. The flaw exists in the VOC, COCO and YOLO export functionalities. These functions invoke a `download` function on the `label-studio-sdk` python package, which fails to validate file paths when processing image references during task exports. By creating tasks with path traversal sequences in the image field, an attacker can force the application to read files from arbitrary server filesystem locations when exporting projects in any of the mentioned formats. This is authentication-required vulnerability allowing arbitrary file reads from the server filesystem. It may lead to potential exposure of sensitive information like configuration files, credentials, and confidential data. Label Studio versions before 1.16.0 specified SDK versions prior to 1.0.10 as dependencies, and the issue was confirmed in Label Studio version 1.13.2.dev0; therefore, Label Studio users should upgrade to 1.16.0 or newer to mitigate it.


vendor: humansignal

summary: Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's `/projects/upload-example` endpoint allows injection of arbitrary HTML through a `GET` request with an appropriately crafted `label_config` query parameter. By crafting a specially formatted XML label config with inline task data containing malicious HTML/JavaScript, an attacker can achieve Cross-Site Scripting (XSS). While the application has a Content Security Policy (CSP), it is only set in report-only mode, making it ineffective at preventing script execution. The vulnerability exists because the upload-example endpoint renders user-provided HTML content without proper sanitization on a GET request. This allows attackers to inject and execute arbitrary JavaScript in victims' browsers by getting them to visit a maliciously crafted URL. This is considered vulnerable because it enables attackers to execute JavaScript in victims' contexts, potentially allowing theft of sensitive data, session hijacking, or other malicious actions. Version 1.16.0 contains a patch for the issue.


archetype: ssrf

summary: Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's S3 storage integration feature contains a Server-Side Request Forgery (SSRF) vulnerability in its endpoint configuration. When creating an S3 storage connection, the application allows users to specify a custom S3 endpoint URL via the s3_endpoint parameter. This endpoint URL is passed directly to the boto3 AWS SDK without proper validation or restrictions on the protocol or destination. The vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal services by specifying them as the S3 endpoint. When the storage sync operation is triggered, the application attempts to make S3 API calls to the specified endpoint, effectively making HTTP requests to the target service and returning the response in error messages. This SSRF vulnerability enables attackers to bypass network segmentation and access internal services that should not be accessible from the external network. The vulnerability is particularly severe because error messages from failed requests contain the full response body, allowing data exfiltration from internal services.


product: strapi

vendor: strapi

summary: Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.

title: Strapi is an open source headless CMS


product: rembg

vendor: danielgatis

summary: Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.


summary: Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.


product: MouseTooltipTranslator

ecosystem: browser

summary: The MouseTooltipTranslator Chrome extension allows mouseover translation of any language at once. The MouseTooltipTranslator browser extension is vulnerable to SSRF attacks. The pdf.mjs script uses the URL parameter from the current URL as the file to download and display to the extension user. Because pdf.mjs is imported in viewer.html and viewer.html is accessible to all URLs, an attacker can force the user’s browser to make a request to any arbitrary URL. After discussion with maintainer, patching this issue would require disabling a major feature of the extension in exchange for a low severity vulnerability. Decision to not patch issue.


product: vega

vendor: vega

summary: Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.


product: core

vendor: home-assistant

summary: Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.


product: misskey

vendor: misskey-dev

vendor: misskey

summary: Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url` fields of ActivityPub objects. An attacker can forge an object where they claim authority in the `url` field even if the specific ActivityPub object type require authority in the `id` field. Version 2025.2.1 addresses the issue.


summary: An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a crafted link.

title: An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user...


summary: An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link.

title: An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via...


summary: An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted link.

title: An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information...


summary: An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via supplying a crafted link.

title: An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive...


summary: An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a crafted link.

title: An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user...


summary: An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link.


summary: An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link.


summary: An issue in IKEA CN iOS 4.13.0 allows attackers to access sensitive user information via supplying a crafted link.


summary: An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link.

title: An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a...


product: libxmljs

summary: A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl nodes causes a segmentation fault, potentially leading to a denial-of-service (DoS).


vendor: tenda

summary: Tenda AC6 V15.03.05.16 firmware has a buffer overflow vulnerability in the formexeCommand function.


vendor: phpgurukul

summary: PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter.


summary: PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter.


summary: A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the pagetitle POST request parameter.

title: Phpgurukul Land Record System security vulnerability


summary: A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactnumber POST request parameter.


summary: A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the fromdate POST request parameter.


summary: A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter.


summary: A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter.


product: publiccms

vendor: publiccms

summary: An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code via uploading a crafted svg or xml file.

title: Publiccms security vulnerability


summary: A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the template field.

title: A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a...


vendor: thepluginpeople

summary: An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload into the HTML field of a template.

title: Thepluginpeople Enterprise Mail Handler security vulnerability


product: speedify

vendor: connectify

summary: A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges.

title: Connectify Speedify security vulnerability


summary: An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive information via the show app only setting function.

title: An issue in realme GT 2 (RMX3311) running Android 14 with realme UI 5.0 allows a physically proximate attacker to obtain sensitive...


vendor: nasa

summary: NASA cFS (Core Flight System) Aquila is vulnerable to path traversal in the OSAL module, allowing the override of any arbitrary file on the system.

title: Nasa Core Flight System security vulnerability


summary: NASA cFS (Core Flight System) Aquila is vulnerable to segmentation fault via sending a malicious telecommand to the Memory Management Module.


summary: The Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the platform.


summary: In NASA cFS (Core Flight System) Aquila, it is possible to put the onboard software in a state that will prevent the launch of any external application, causing a platform denial of service.


summary: Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component.

title: 07Fly 07Flycms security vulnerability


summary: Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames and passwords.

title: Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive...


product: sanchaya

vendor: ikm

summary: An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted request.

title: Ikm Sanchaya security vulnerability


summary: A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the propertytype POST request parameter.


summary: A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the editid GET request parameter.


summary: A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.


summary: Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.


product: yshopmall

vendor: guchengwuyue

summary: yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.


vendor: TP-Link Systems Inc.

vendor: tp-link

summary: A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload when the upnp page is loaded.

title: Tp-Link Wr841N Firmware security vulnerability


vendor: trendnet

summary: TRENDnet TEW-929DRU 1.0.0.10 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.

title: Trendnet Tew-929Dru Firmware security vulnerability


summary: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name function on the /addschedule.htm page.


summary: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htm page.


summary: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the The ssid key of wifi_data parameter on the /captive_portal.htm page.


product: mytaag

vendor: mytaag

summary: An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint

title: Mytaag security vulnerability


summary: An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_authorized" Local Storage key

title: Mytaag security vulnerability


summary: An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint


summary: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serviceName2.


summary: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2.


summary: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2.


summary: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2.


summary: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via cloneType2.


summary: Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2.


product: flatpress

vendor: flatpress

summary: A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form.


product: seeddms

vendor: seeddms

summary: A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.


summary: A SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote attackers to execute arbitrary code via the propertytype POST request parameter.


summary: Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file.

title: Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via...


product: ffmpeg

vendor: ffmpeg

summary: FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c.


summary: FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c.


summary: FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c.


product: dcmtk

vendor: offis

vendor: debian

summary: A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file.


summary: FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c.


summary: DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h.


summary: A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file.

title: Offis Dcmtk security vulnerability


product: syspass

vendor: syspass

summary: A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component.

title: Syspass security vulnerability


summary: A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser.

title: Syspass security vulnerability


summary: The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.


summary: An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field due to client-side-only restrictions and a lack of server-side validation. This vulnerability enables account ownership reassignment to or away from any user.

title: An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the...


product: cosmwasm

vendor: cosmwasm

summary: An issue in CosmWasm prior to v2.2.0 allows attackers to bypass capability restrictions in blockchains by exploiting a lack of runtime capability validation. This allows attackers to deploy a contract without capability enforcement, and execute unauthorized actions on the blockchain.

title: Cosmwasm security vulnerability


vendor: niceforyou

summary: An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges.

title: Niceforyou Gefen Webfwc security vulnerability


vendor: tenda

summary: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the sub_452A4 function.


summary: There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution.


summary: Tenda AC8 V16.03.34.06 is vulnerable to Buffer Overflow in the get_parentControl_list_Info function.


product: seacms

vendor: seacms

summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.


summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.


summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.


summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.


summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.


summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.


summary: Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.


summary: Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.


vendor: linksys

summary: Buffer overflow vulnerability in Linksys WAP610N v1.0.05.002 due to the lack of length verification, which is related to the time setting operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability.

title: Linksys Wap610N Firmware security vulnerability


summary: Buffer overflow vulnerability in Trendnet TEG-40128 Web Smart Switch v1(1.00.023) due to the lack of length verification, which is related to the mobile access point setup operation. The attacker can directly control the remote target device by successfully exploiting this vulnerability.

title: Trendnet Teg-40128 Firmware security vulnerability


vendor: totolink

summary: Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length verification, which is related to the addition of Wi-Fi filtering rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

title: Totolink X6000R Firmware security vulnerability


summary: Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to the setting of firewall rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

title: Buffer overflow vulnerability in H3C FA3010L access points SWFA1B0V100R005 due to the lack of length verification, which is related to...


summary: Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the configuration of the PPTP server. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

title: Buffer overflow vulnerability in Mercury MIPC552W Camera v1.0 due to the lack of length verification, which is related to the...


vendor: ruijie

summary: Buffer overflow vulnerability in Ruijie RG-NBR2600S Gateway 10.3(4b12) due to the lack of length verification, which is related to the configuration of source address NAT rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

title: Ruijie Rg-Nbr2600S Firmware security vulnerability


vendor: wavlink

summary: Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. By successfully exploiting the vulnerabilities, attackers can crash the remote devices or execute arbitrary commands without any authorization verification.

title: Wavlink Wl-Wn575A3 Firmware security vulnerability


summary: Buffer overflow vulnerability in Digital China DCBC Gateway 200-2.1.1 due to the lack of length verification, which is related to the configuration of static NAT rules. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

title: Buffer overflow vulnerability in Digital China DCBC Gateway 200-2.1.1 due to the lack of length verification, which is related to the...


summary: Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to saving parental control configuration information. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

title: Buffer overflow vulnerability in Digital China DCBI-Netlog-LAB Gateway 1.0 due to the lack of length verification, which is related to...


summary: HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.


vendor: onespan

summary: Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu.


product: vpn

vendor: softether

summary: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a command line.


summary: Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function. NOTE: the Supplier disputes this because the behavior is limited to a single allocation of a few hundred bytes with a command-line tool.


summary: SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the behavior only enables a local user to attack himself through the UI,


summary: SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function. NOTE: the Supplier disputes this because the use-after-free is not in the VPN software, but is instead in a separate tool that has no untrusted input and runs under the user's own privileges (it is a stress-testing tool for a networking stack).


summary: Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials.


summary: TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr.


product: yimioa

summary: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the listNameBySql() method at /xml/UserMapper.xml.


summary: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml.

title: R1Bbit Yimioa security vulnerability


summary: Incorrect access control in the component /config/WebSecurityConfig.java of yimioa before v2024.07.04 allows unauthorized attackers to arbitrarily modify Administrator passwords.

title: R1Bbit Yimioa security vulnerability


summary: yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.


summary: An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitrary code via supplying a crafted XML file.

title: An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows...


summary: yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the component /mapper/xml/AddressDao.xml.


product: safe

vendor: iitb

summary: A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack.


vendor: inovalogic

summary: Incorrect access control in the scheduled tasks console of Inova Logic CUSTOMER MONITOR (CM) v3.1.757.1 allows attackers to escalate privileges via placing a crafted executable into a scheduled task.

title: Inovalogic Customer Monitor security vulnerability


summary: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.


summary: Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.


summary: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6 parameter in the formIpv6Setup interface of /bin/boa


summary: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_gw parameter in the formIpv6Setup interface of /bin/boa.


summary: FS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious JavaScript into the "Time Range Name" field, which is improperly sanitized. When this input is saved, it is later executed in the browser of any user accessing the affected page, including administrators, resulting in arbitrary script execution in the user's browser.

title: FS Inc S3150-8T2F security vulnerability


vendor: fs

summary: FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encoding during every POST request made to the server.


product: unifiedtransform

vendor: changeweb

summary: Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.

title: Changeweb Unifiedtransform security vulnerability


severity: low

summary: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.


summary: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.


summary: Incorrect Access Control in Unifiedtransform 2.X leads to Privilege Escalation allowing teachers to create syllabus.


summary: Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.


summary: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses/teacher/index?teacher_id=2&semester_id=1.


summary: A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an authenticated web interface user to bypass input filtering on user names, and stores un-sanitized HTML and Javascript on the device. Pages which then present the user name without encoding special characters will then cause the injected code to be parsed by the browsers of other users accessing the web interface.

title: Fs S3150-8T2F Firmware security vulnerability


summary: Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.


summary: A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src leads to stack-based buffer overflow.


summary: TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface of /bin/boa.


summary: An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC cards to bypass authentication.

title: An issue in the storage of NFC card data in Dorset DG 201 Digital Lock H5_433WBSK_v2.2_220605 allows attackers to produce cloned NFC...


product: archibus

vendor: eptura

summary: In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.

title: Eptura Archibus security vulnerability


summary: Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the argument remark/type/time.

title: Tenda O4 Firmware security vulnerability


summary: A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk_crypto leads to stack-based buffer overflow.


summary: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 function.


summary: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info.


summary: Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 function.


summary: Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form_fast_setting_wifi_set via the parameter ssid.


summary: Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter from a POST request and is later assigned to the cmd_buf variable, which is directly used in the doSystemCmd function, causing an arbitrary command execution.


summary: Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function.


summary: Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.


summary: Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function.


vendor: lsc

summary: LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya_ipc_direct_connect function of the anyka_ipc process. The vulnerability allows arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera.

title: Lsc Ptz Dual Band Camera Firmware security vulnerability


summary: AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1.


summary: A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request.

title: A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary...


summary: An issue was discovered in GL-INet Beryl AX GL-MT3000 v4.7.0. Attackers are able to download arbitrary files from the device's file system via adding symbolic links on an external drive used as a samba share.


product: semcms

vendor: sem-cms

summary: semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.


product: prestashop

vendor: prestashop

summary: A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

title: Prestashop security vulnerability


summary: A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.

title: Prestashop security vulnerability


summary: An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the addUser and updateUser endpoints


summary: An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/admin/updateUser] API endpoint

title: An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the...


product: gpac

vendor: gpac

summary: Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.


product: libarchive

vendor: libarchive

summary: list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

title: Libarchive security vulnerability


summary: Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.


summary: Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintext, allowing attackers to access sensitive information via a man-in-the-middle attack.

title: Bosscomm IF740 Firmware security vulnerability


summary: An information disclosure vulnerability in Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 allows attackers to obtain hardcoded cleartext credentials via the update or boot process.

title: An information disclosure vulnerability in Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00...


summary: An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate unauthorized attackers to access USB debugging, leading to control of the host device itself.

title: An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate...


vendor: kapsch

summary: Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.

title: Kapsch Ris-9160 Firmware security vulnerability


summary: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.


summary: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.


summary: Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.


summary: Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass authentication via a bruteforce attack.


vendor: dlink

summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the PSK parameter in the SetQuickVPNSettings module.

title: Dlink Dir-853 Firmware security vulnerability


summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettings module.


summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module.


summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.


summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module.


summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetQuickVPNSettings module.


summary: D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetWanSettings module.


product: hoteldruid

vendor: digitaldruid

summary: Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristina_backup parameter in the crea_backup.php endpoint

title: Digitaldruid Hoteldruid security vulnerability


summary: A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords) on behalf of authenticated users by exploiting the lack of origin or referrer validation and the absence of CSRF tokens. NOTE: this is disputed because there is an id_sessione CSRF token.


summary: An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.


product: kukufm

vendor: kukufm

summary: An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml

title: Kukufm security vulnerability


product: sucms

summary: An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET request.

title: Sucms Project Sucms security vulnerability


summary: A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET request.


product: hkcms

vendor: hkcms

summary: HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php.


product: crmeb

vendor: crmeb

summary: crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php


product: mrcms

vendor: mrcms

summary: MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.


summary: An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file.

title: Mrcms security vulnerability


summary: A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request.

title: Mrcms security vulnerability


summary: MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

title: Mrcms security vulnerability


product: wangmarket

summary: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java.


summary: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java.


product: jspxcms

vendor: ujcms

summary: A Cross-Site Request Forgery (CSRF) in the component /back/UserController.java of Jspxcms v9.0 to v9.5 allows attackers to arbitrarily add Administrator accounts via a crafted request.

title: Ujcms Jspxcms security vulnerability


summary: An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal state machine, leading to an AMF crash and resulting in a Denial of Service (DoS).


vendor: codeastro

summary: Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.


summary: Cross-Site Scripting (XSS) vulnerability exists in the User Registration and User Profile features of Codeastro Bus Ticket Booking System v1.0 allows an attacker to execute arbitrary code into the Full Name and Address fields during user registration or profile editing.

title: Codeastro Bus Ticket Booking System security vulnerability


summary: Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in the URL, an attacker can access another user's profile without proper authentication or authorization checks.


product: emlog

vendor: emlog

summary: An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.

title: Emlog security vulnerability


product: jizhicms

vendor: jizhicms

summary: An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.

title: Jizhicms security vulnerability


summary: JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.


product: foxcms

vendor: foxcms

summary: FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.


summary: An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.

title: Foxcms security vulnerability


product: yzncms

vendor: yzncms

summary: An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.

title: Yzncms security vulnerability


product: seacms

vendor: seacms

summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.


summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.


summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.


summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.


summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.


summary: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.


summary: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.


summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.


summary: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.


summary: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.

title: Emlog security vulnerability


summary: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.

title: Emlog security vulnerability


summary: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.

title: Emlog security vulnerability


summary: A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.

title: Emlog security vulnerability


product: openpanel

vendor: openpanel

summary: An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function


title: An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function


product: openadmin

summary: Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges via the Change Root Password function

title: Openpanel Openadmin security vulnerability


vendor: angeljudesuarez

summary: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL injection to obtain sensitive data.


summary: A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data.


summary: A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.


summary: A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.


summary: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.

title: Dlink Dsl-3782 Firmware security vulnerability


summary: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.


summary: An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arbitrary operating system (OS) commands via a crafted packet.


summary: A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.


vendor: tp-link

summary: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the 'ip' parameter at /userRpm/WanStaticIpV6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.


summary: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSecurityRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.


summary: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /userRpm/PPPoEv6CfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

title: Tp-Link Tl-Wr841Nd V11 Firmware security vulnerability


summary: A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 parameters at /userRpm/WanSlaacCfgRpm.htm. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted packet.

title: Tp-Link Tl-Wr841Nd Firmware security vulnerability


product: cadclick

summary: Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter.

title: 4Pace Cadclick security vulnerability


product: tianti

summary: tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.


summary: A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.

title: Tianti Project Tianti security vulnerability


vendor: carmelo

summary: SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter


product: wuzhicms

vendor: wuzhicms

summary: wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.


product: openmrs

vendor: openmrs

summary: A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form.

title: Openmrs security vulnerability


summary: A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request.

title: Openmrs security vulnerability


summary: A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrative role by leveraging the CSRF vulnerability at the /admin/users/user.form endpoint.

title: Openmrs security vulnerability


summary: A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter.

title: Openmrs security vulnerability


vendor: reprisesoftware

summary: Reprise License Manager 14.2 is vulnerable to reflected cross-site scripting in /goform/activate_process via the akey parameter.


product: visicut

vendor: visicut

summary: VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.


vendor: axiosys

summary: An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memory allocated in SampleArray::SampleArray in Mp4Fragment.cpp is not properly released.


summary: Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in Ap4Stz2Atom.cpp.

title: Axiosys Bento4 security vulnerability


summary: Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_RtpAtom, during the execution of mp4fragment with a crafted MP4 input file.

title: Axiosys Bento4 security vulnerability


summary: An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFromStream at Ap4DescriptorFactory.cpp.

title: Axiosys Bento4 security vulnerability


summary: An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcessor::Initialize and AP4_Processor::Process, during the execution of mp4encrypt with a specially crafted MP4 input file.

title: Axiosys Bento4 security vulnerability


summary: An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the execution of mp4encrypt with a specially crafted MP4 input file.

title: Axiosys Bento4 security vulnerability


vendor: academiaerp

summary: Incorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.

title: Academiaerp Student Information System security vulnerability


summary: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update.


vendor: serosoft

summary: Incorrect access control in the component /rest/staffResource/update of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows create and modify user accounts, including an Administrator account.

title: Serosoft Academia Student Information System security vulnerability


summary: An information disclosure vulnerability in the component /rest/cb/executeBasicSearch of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information.


summary: An Insecure Direct Object References (IDOR) in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to access sensitive user information via a crafted API request.


summary: Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 was discovered to contain an Azure JWT access token exposure. This vulnerability allows authenticated attackers to escalate privileges and access sensitive information.


product: xunruicms

vendor: xunruicms

summary: Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script.


product: phpcms

vendor: phpcms

summary: Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script.


summary: Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator.

title: Phpcms security vulnerability


summary: An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function

title: An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition...


vendor: ddsn

summary: Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allows exploitation via crafted requests.


summary: DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.g., cm3.xml), attackers can bypass access controls, leading to account takeover and potential privilege escalation.


product: ppress

vendor: yandaozi

summary: A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a crafted script to the article.title, article.category, and article.tags parameters.

title: Yandaozi Ppress security vulnerability


product: parse-git-config

vendor: jonschlinkert

summary: An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function


product: canvg

vendor: canvg

summary: An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.


vendor: macro-video

summary: An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via UART component.

title: Macro-Video V380E6 C1 Firmware security vulnerability


product: hoosk

vendor: hoosk

summary: Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter.

title: Hoosk security vulnerability


summary: Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.

title: Hoosk security vulnerability


summary: SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.

title: Hoosk security vulnerability


summary: SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component.

title: Feminer Wms Project Feminer Wms security vulnerability


summary: SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid."