CVE Vulnerability Catalog

SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.

An authenticated attacker can exploit logical errors in memory management in SAP NetWeaver Application Server ABAP, causing memory corruption. This could lead to unauthorized data access, modification, or system unavailability.

An HTTP Request Smuggling vulnerability in SAP Approuter allows an unauthenticated attacker to send a crafted HTTP request, causing request-response desynchronization. This can expose user responses and make the system unavailable, with high impact on confidentiality and availability.

A vulnerability in the Crypt::OpenSSL::X509 library for Perl before version 2.1.3 allows a heap out-of-bounds read via a long certificate extension OID. Functions like extensions(), extensions_by_long_name(), extensions_by_oid(), and has_extension_oid() incorrectly use the full OID text length as the hash key length, causing a read past the fixed-size 129-byte buffer.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.

9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.

A vulnerability in D-Link DIR-1253 version 1.0.1.250923.142435 allows privilege escalation via the etc/shadow file. An attacker can exploit this flaw to gain unauthorized access to user accounts.

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint.

An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.

An out-of-bounds read vulnerability was found in EIPStackGroup OpENer version 2.3.0 (commit 76b95cf) in the Connection Manager handling of ForwardOpen requests. The issue occurs when processing short malformed packets, where the parser continues reading fields even when request data is insufficient.

In OpENer 2.3.0 (commit 76b95cf) when parsing CIP packets, the length parameter is inconsistently typed across the call stack. An int length is passed to a function expecting EipInt16, allowing crafted packets to cause overflow or negative values. This bypasses bounds checks and leads to a stack buffer overflow in DecodePaddedEPath.

In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.

A remote code execution vulnerability was identified in the ServiceNow AI platform, potentially allowing an unauthenticated user to execute code under certain circumstances. The issue has been addressed with security updates for hosted and self-hosted instances.

The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 derives the session-cookie signing key from the non-cryptographic Math.random() generator and discloses its outputs to unauthenticated clients during login. A remote attacker can collect a few login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

A signed integer overflow vulnerability in Storable versions before 3.41 for Perl occurs when deserializing a crafted SX_HOOK record. The retrieve_hook_common function reads a signed 32-bit item count, and adding one to I32_MAX wraps it to a negative value.

In Perl versions up to 5.43.9, when compiling an alternation of more than 65535 fixed string branches into a trie in Perl_study_chunk, a 16-bit field storing the delta between the first branch and the shared tail overflows. This truncates the trie's match decision table without warning or error, causing false positive and false negative regular expression matches.

A remote code execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. An unauthenticated attacker can upload arbitrary PHP files by providing a base64-encoded payload and execute arbitrary code on the server. The issue has been fixed in a patch released in April 2026.

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint. Attackers can execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Lack of input sanitization leads to direct command execution via passthru() with root privileges.