CVE Vulnerability Catalog

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request, which can cause the service to crash.

Tenda CP3 V3.0 firmware V31.1.9.91 fails to validate the Content-Length header in RTSP requests (DESCRIBE, SETUP, PLAY). When a request includes this header without a body, the RTSP parser enters a persistent body-awaiting state, permanently blocking the TCP connection. An unauthenticated remote attacker can exploit this to exhaust TCP resources and cause a denial-of-service condition.

The incremental HTML parser (html.parser.HTMLParser) allows CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the /login.php file. An attacker can remotely manipulate the Username argument, leading to unauthorized database access. The exploit is publicly available.

PayRange Android app version 7.0.7 and below has an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote, unauthenticated attacker can steal information sent by the user.

In n8n, an open source workflow automation platform, prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This allowed unauthenticated requests to be treated as a privileged user and exposed user and project listing endpoints.

Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.

A null pointer dereference vulnerability exists in Zeek before 8.0.9 in its Kerberos protocol analyzer. An unauthenticated remote attacker can crash the sensor by sending a crafted KRB_ERROR message with error code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19.

A vulnerability in the FTP analyzer of Zeek before version 8.0.9 allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. The NVT_Analyzer component lacks a maximum line length check, causing uncontrolled memory consumption during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.

A SQL Injection vulnerability in the AcyMailing extension for Joomla versions below 10.11.1 allows unauthorized database access and data leakage.

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) is caused by insufficient validation of authentication credentials during administrative account modifications via the web API. This allows an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.

An LDAP injection vulnerability in PEAKUP Technology Inc.'s PassGate allows attackers to manipulate LDAP queries due to improper neutralization of special elements. This issue affects all PassGate versions up to April 30, 2026.

An internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) failed to enforce sufficient permissions when creating an API token for another user. An attacker knowing the login name of a privileged internal user and authenticated via OAuth/OIDC could forge a token creation request on their behalf.

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping.

A stack buffer overflow vulnerability exists in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is copied into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN, causing a stack buffer overflow and process crash.

A heap buffer overflow vulnerability exists in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker with parameters_all rights can inject SQL commands into the audit configuration form which is then saved. Execution is triggered when the audit functionality is accessed by the attacker or another user.

The Divi Torque Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, bypassing WordPress's built-in nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the lack of nonce verification allows a forged request from a logged-in administrator's browser to pass the capability check via session cookies.

The Bit Form plugin for WordPress up to version 3.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.

The EventPrime plugin for WordPress up to version 4.3.4.2 is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary web scripts that execute when users access the affected page.