CVE Vulnerability Catalog

A vulnerability in USCiLab Cereal up to 1.3.2 in the Shared Pointer Handler component can lead to type confusion. The attack can be launched remotely. The exploit has been publicly disclosed.

BeikeShop up to version 1.6.0.22 has an improper authorization vulnerability in the Stripe Plugin component in StripeController.php via the Request argument. The attack can be performed remotely, and the exploit is publicly available. A patch is available at commit 6719e0fc.

A flaw has been found in Boost Serialization involving improper validation of a specified type of input. The attack can be initiated remotely, and a public exploit has been published and may be used. The maintainer was notified in August 2025 and acknowledged but postponed the fix indefinitely, so no patch is currently available and the disclosure deadline has expired.

Xcitium Client Security before 13.8.2.10019 and Comodo Internet Security through 12.3.4.8162 have an integer underflow in the firewall driver Inspect.sys. Sending a crafted IPv6 packet with payload length smaller than extension-header lengths causes an out-of-bounds read and system crash (BSOD).

Injection vulnerability in JeeWMS (up to 141740afb2ba14d441c82a833d0a418d07ca2d69) in /base-boot/jmreport/testConnection via dbType/dbDriver/dbUrl/dbUsername/dbPassword arguments. Remote attack, exploit public.

A SQL injection vulnerability was found in Chanjet CRM 1.0 in the file /tools/jxf_dump_systable.php via the gblOrgID argument in the HTTP GET Request Handler component. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.

A command injection vulnerability was found in GL.iNet GL-MT3000 up to version 4.4.5 in the function FUN_0042e200 of /cgi-bin/glc. The vendor claims it is fixed in version 4.8.1, but details are disputed.

In the GL.iNet GL-MT3000 device with firmware version 4.4.5, a command injection vulnerability was found in the snprintf function of the file /cgi-bin/glc in the FTP Protocol Handler component. Manipulating the media_dir argument can lead to command injection. The attack can be launched remotely. The vendor states that in version 4.8.1, single quotes are escaped, preventing the reported attack vectors.

A command injection vulnerability exists in the dlopen function of the /usr/lib/oui-httpd/rpc/ library in GL.iNet GL-MT3000 version 4.4.5 via the dev_name argument. The attack is remotely exploitable. The vendor confirms that version 4.7 introduces HTTP method-level validation, mitigating the issue.

clash-verge-service-ipc before version 2.3.0 exposes a world-reachable IPC endpoint, allowing local privilege escalation.

Server-side request forgery (SSRF) vulnerability in perfree go-fastdfs-web up to version 1.3.7. The checkServer function in /install/checkServer allows remote manipulation leading to SSRF. Exploit has been published and may be used. Vendor did not respond.

A SQL injection vulnerability was found in Jinher OA 1.0 in the file nextselectplan.aspx via the httpOID argument. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor did not respond.

Vulnerability in JingDong JD Cloud Box AX6600 (version 4.5.3.r4546) in the set_macfilter function. Manipulation leads to stack-based buffer overflow, enabling remote attack.

A vulnerability in the Protocol::HTTP2 library for Perl before version 1.13 allows an HTTP/2 Bomb attack. The HPACK decode path lacks a header-list size limit, so a small HTTP/2 request can expand into large server memory. The headers_decode method performs no running size check, and stream_header_block_add appends CONTINUATION frames unbounded.

A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.

The MDJM Event Management plugin for WordPress up to version 1.7.8.3 is vulnerable to Arbitrary File Upload via the mdjm_send_comm_email function due to lack of file type, extension, or MIME type validation. This allows authenticated attackers with administrator-level access to upload executable files, leading to remote code execution.

The Integration for Freshsales plugin for WordPress up to version 1.0.15 is vulnerable to stored XSS via form submission data due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an admin views CRM API error details.

The All-In-One Security (AIOS) plugin for WordPress up to version 5.4.7 is vulnerable to Stored XSS. An unauthenticated attacker can inject arbitrary HTML/JavaScript into the REST request path, which is stored in debug logs. When an admin views the debug log page, the script executes in their browser.

The WP User Manager – User Profile Builder & Membership plugin for WordPress up to version 2.9.17 has a Local File Inclusion vulnerability in the profile template scope function. Unauthenticated attackers can include and execute arbitrary .php files on the server, allowing access control bypass, sensitive data disclosure, or code execution.

Tapo C520WS v2 has a logic flaw in its API authorization mechanism. Restricted accounts can bypass whitelist restrictions and perform unauthorized operations like device reset or configuration changes.