CVE Vulnerability Catalog

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query in the getListForTbl() function.

An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections.

The 'Kura Sushi Official App' provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.

The Zyxel NWA1100-N firmware version contains a buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions. An attacker can exploit this flaw by sending a crafted HTTP request, potentially leading to a denial-of-service (DoS) condition.

A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request.

The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter, exposing the authorization flow to CSRF attacks.

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system.

A vulnerability chain in Cribl Edge for Windows before version 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's authentication directory expose a cryptographic secret used for JWT signing and password-hash derivation.

W Cribl Stream przed wersją 4.17.1 występuje podatność typu DOM-based cross-site scripting (XSS), która pozwala zdalnemu atakującemu na wykonanie dowolnego kodu JavaScript w przeglądarce uwierzytelnionego użytkownika, który zostanie oszukany do odwiedzenia spreparowanego URL-a i interakcji z stroną.

W Cribl Edge dla systemu Linux w wersjach od 3.2.0 do 4.17.0 występuje podatność na wstrzykiwanie poleceń, która pozwala lokalnemu użytkownikowi bez uprawnień na wykonywanie dowolnych poleceń w kontekście konta usługi Cribl Edge.

In Vaultwarden, prior to version 1.35.4, there is a vulnerability that allows bypassing brute-force login protection if email 2fa is enabled. The 2fa function send_email_login acts as an oracle, enabling attackers to test username-password combinations without rate limiting.

Vaultwarden, a Bitwarden-compatible server, prior to version 1.35.5 allowed an unconfirmed organization owner to purge the entire organization vault. The organization invite flow did not verify confirmation status, enabling a user invited as an owner to delete data.

Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, nor that a collections_groups.collections_uuid entry belongs to the same organization as collections_groups.groups_uuid. An Admin in Organization A who is only a low-privileged member in Organization B can bind their Org B membership into an Org A group and gain unauthorized access to Org B vault data.

In barebox bootloader prior to version 2026.04.0, multiple memory-safety vulnerabilities exist in the EFI PE loader (efi/loader/pe.c). Integer overflow in virtual image size calculation and missing validation of PointerToRawData lead to undersized heap allocation and out-of-bounds heap read. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially causing heap buffer overflow and code execution in bootloader context.

Link Preview JS prior to version 4.0.1 did not check for IPv6 loopback attacks and DNS attacks, which could lead to internal data leaks.

The vulnerability in exiftool-vendored before version 35.19.0 allows argument injection into ExifTool by not rejecting newline characters in supplied strings. This can lead to a single intended argument being split into multiple arguments, creating a risk of argument manipulation.

Outline is a service that allows for collaborative documentation, which in versions from 0.84.0 to 1.7.0 has an authorization issue in the subscriptions.create API endpoint. When both collectionId and documentId are supplied, authorization only checks collectionId, allowing an attacker to pin a subscription to a document they do not have access to.

The Outline service, allowing collaborative documentation, had a vulnerability in the ZipHelper.extract function prior to version 1.7.0, which incorrectly computed the extraction path for zip entries. For long paths, this function dropped all directory components, leading to files being opened in the wrong location.

Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.

Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.