CVE Vulnerability Catalog

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Protect Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress (up to version 1.17.8) is vulnerable to unrestricted file upload via the save_attachments() function. Missing file extension validation and path normalization allow unauthenticated attackers to write malicious PHP outside the .htaccess-protected directory, potentially leading to remote code execution if PHP executes in uploads.

TarsWeb trusts a client-controlled X-Forwarded-For header, allowing an attacker to impersonate a local caller. By forging a loopback address and providing a uid of an existing account, an attacker can access the console as any user, including administrator, without credentials. Version 3.0.16 fixes this.

An attacker with network access, low privileges, and under certain conditions can exploit an active debug code vulnerability in devices running UniFi OS to escalate privileges within those devices or instances.

An attacker with network access and low privileges can exploit an improper input validation vulnerability in the UniFi Access Application to execute a command injection on the host device.

An attacker with network access and high privileges can exploit an improper input validation vulnerability in UID Enterprise Agent to execute a command injection on the host device.

An attacker with network access and high privileges can exploit an improper access control vulnerability in the UniFi Network Application to escalate privileges within the application.

An attacker with network access and high privileges can exploit an improper input validation vulnerability in UniFi OS Server to execute a command injection on the host device.

An attacker with network access and high privileges can exploit an improper input validation vulnerability in UniFi OS Server to execute a command injection on the host device.

An attacker with network access can exploit an improper input validation vulnerability in the UniFi Protect Application to execute a command injection on the host device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in devices running UniFi OS to escalate privileges within such devices or instances.

An attacker with network access and high privileges could exploit an Improper Input Validation vulnerability in UniFi Network Application to execute a Command Injection on an adopted device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in devices running UniFi OS to escalate privileges within such devices or instances.

The OpenRGB network protocol allows writing attacker-controlled strings to arbitrary file system paths (extension of CVE-2026-59682). This can lead to full system compromise from local or remote (if the daemon runs as root) or full account takeover (if the daemon runs in user context).

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

An Improper Input Validation vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to execute a Command Injection on the host device.

When ranges are used for access control (e.g., 1.2.3.4-1.2.3.25), NSD wrongly compares the IP address with the range on little endian systems, causing IPs that were meant to be allowed to be denied, and IPs that were meant to be denied to be allowed.