CVE Vulnerability Catalog

Tenable Security Center has a command injection vulnerability. An authenticated administrator can modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.

Dell Wyse Management Suite (WMS) before version 2605.0.2 has an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access can exploit this to achieve remote code execution.

Dell Wyse Management Suite (WMS) before version 2605.0.2 has an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access can exploit this to achieve remote code execution.

Dell Wyse Management Suite (WMS) before version 2605.0.2 has an Incorrect Default Permission vulnerability. A low privileged attacker with local access can exploit this to achieve privilege escalation.

ZeroBrew version 0.3.1 and prior has a missing integrity verification vulnerability in the Ruby compatibility shim. Network attackers can substitute malicious content at formula resource or URL-based patch URLs, executing arbitrary code during source builds.

In Eclipse Theia up to version 1.69.0, opening a folder starts source control integration without first asking the user to trust the folder. Applications built on Theia that include git integration execute git commands (e.g., git status) as soon as a repository is detected. Because git honors repository-local configuration, a folder with an attacker-controlled .git/config containing core.fsmonitor can cause the configured command to be executed. Cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with user privileges, without any confirmation prompt.

In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the `UpdateUser` job, which processes user-supplied role assignments via an unconditional `roles()->sync()` call without verifying whether the caller is authorized to manage roles. Users only require the default `update-auth-profile` permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue.

In KUNBUS piControl version 2.6.2, a CWE-362 race condition vulnerability exists in the configuration and process-image management functionality. It allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects by sending concurrent crafted requests through the piControl character device, leading to kernel memory corruption and denial of service.

In KUNBUS piControl version 2.6.2, a CWE-787 out-of-bounds write vulnerability exists in the process-image management functionality. It allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, by supplying crafted device configuration data and input through the piControl character device, leading to kernel memory corruption and denial of service.

Datavane TIS v5.0.0 contains an XML External Entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration. The vulnerability arises from processing XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document with an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files, including configuration files and Derby database credentials.

The JSON plugin in Apache Struts has an uncontrolled resource consumption vulnerability. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. Affected versions: Apache Struts from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

In Devolutions PowerShell Universal version 2026.2.3 and earlier, a code injection vulnerability exists in the settings feature. An authenticated user with settings management permission can execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentication because Boa grants access to any path containing '.cgi' regardless of cookie validation, and netis.cgi reads but does not enforce the authentication state before invoking the firmware update handler, which accepts images validated only by a forgeable additive checksum and static product strings rather than a cryptographic signature, potentially enabling persistent router compromise.

In the payroll module in Roskus Prospero Flow CRM before 5.15.10, an authorization bypass through user-controlled key vulnerability exists. Authenticated users holding the read payroll permission can view salary and banking details of employees of any other company in the instance, and users holding the create payroll permission can create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership.

In alldatacenter alldata up to version 0.6.8, a deserialization vulnerability exists in the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java in the xxl-rpc Listener component. The manipulation results in deserialization, and the attack can be performed remotely. The exploit is now public and may be used. The project closed the issue report as 'not planned' without further explanation.

In SourceCodester Simple Client Management System 1.0, a SQL injection vulnerability exists in an unknown function of the file /classes/Master.php?f=save_service. Manipulation of the argument ID leads to SQL injection. The attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A stack-based buffer overflow vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the ipMacBindListStore function of /goform/addIpMacBind. Manipulating the IPMacBindRule argument can lead to buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC in the formQOSRuleDel function of /goform/delQos. Manipulating the qosIndex argument results in buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRITE check, which BASIC users hold by default. Attackers can specify arbitrary S3 buckets in the request body to generate presigned URLs for writing to any bucket accessible by the stored IAM credentials, enabling unauthorized file uploads.

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.