CVE Vulnerability Catalog

A vulnerability in Xerte Online Tools allows remote code execution (RCE) by changing the antivirus binary path in the server settings to a PHP interpreter. An attacker can then upload PHP data that will be executed on the server.

An SQL injection vulnerability was found in BiEticaret by Inrove Software and Internet Services due to improper neutralization of special elements in SQL commands. This allows an attacker to execute arbitrary SQL queries on the database.

A stored Cross-Site Scripting (XSS) vulnerability has been found in ValeApp by OceanicSoft Informatics Systems Ltd., due to improper input neutralization during web page generation. This issue affects all versions up to 09072026.

The Blocksy Companion plugin for WordPress is vulnerable to arbitrary file upload in versions up to 2.1.46. The flaw lies in the save_attachments function, which improperly validates file extensions, allowing double-extension files like shell.woff2.php to bypass MIME checks. This can lead to remote code execution, but exploitation requires the premium plugin with specific extensions active.

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed and relying solely on a public `form_nonce` nonce.

A path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information via the blobs.yml file. Affected versions are prior to v7.10.4.

A cross-site scripting (XSS) vulnerability in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network due to improper input neutralization during web page generation.

A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.

A Use-After-Free vulnerability in the Autofill feature of Google Chrome on Android prior to version 150.0.7871.115 allows a remote attacker to potentially escape the sandbox via a crafted HTML page.

A vulnerability in HAPI FHIR before version 6.9.10 allows XML External Entity (XXE) injection via the saxonTransform function in XsltUtilities. Missing ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions enable an attacker to read local files, perform blind XXE, and SSRF to arbitrary URLs.

A vulnerability in the Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk.

Fluentd before version 1.19.3 allows dynamically constructing file paths using the ${tag} placeholder. Insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin lets attackers send untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.

An improper authorization vulnerability in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to overwrite the node's configuration and achieve full node takeover via a crafted POST request.

The JupyterLab Git extension before version 0.54.0 contains an XSS vulnerability in the createHeader() method of PlainTextDiff.ts. When rendering renamed files in commit history, filenames are passed directly to innerHTML, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab.

IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.

Repomix contains a server-side request forgery (SSRF) vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.

SQL injection vulnerabilities in Snowpark Python SDK prior to version 1.53.0 allow authenticated low-privilege users to execute SQL beyond their authorization scope. Attackers can exploit these via crafted database column names, location parameters, or export paths.

The Blocksy Companion Pro plugin for WordPress before version 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.

Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.