CVE Vulnerability Catalog

Multiple D-Link device models (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) up to version 20260205 contain a stack-based buffer overflow vulnerability in the function cgi_adduser_to_session in the file /cgi-bin/account_mgr.cgi. Manipulation of the read_list argument leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit is publicly available.

Multiple D-Link device models (including DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, DNS-1550-04) up to version 20260205 contain a stack-based buffer overflow vulnerability in the Webdav_Upload_File function of /cgi-bin/webdav_mgr.cgi via the f_file argument. The attack can be performed remotely and the exploit is publicly available.

WWBN AVideo versions 26.0 and prior have a vulnerability in the on_publish_done.php endpoint in the Live plugin that allows unauthenticated users to terminate any active live stream. An attacker can enumerate stream keys from the stats.json.php endpoint and send crafted POST requests to stop broadcasts.

WWBN AVideo up to version 26.0 lacks CSRF token validation in the admin plugin configuration endpoint (admin/save.json.php). Combined with SameSite=None cookie policy, an attacker can forge cross-origin POST requests to overwrite arbitrary plugin settings on an admin session. Bypassing table-level access controls allows full platform takeover.

Admidio versions 5.0.0 through 5.0.7 rely on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, causing Apache to silently ignore all .htaccess files. As a result, any file uploaded to the documents module is directly accessible over HTTP without authentication to anyone who knows the file path. This issue has been patched in version 5.0.8.

InvoiceShelf prior to version 2.2.0 has an SSRF vulnerability in the PDF generation module. User-supplied HTML in the Notes field is passed unsanitized to the Dompdf library, which fetches remote resources, exploitable via PDF preview and email delivery endpoints.

InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF receipt generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.

Multiple D-Link devices (including DNS-120, DNR-202L, DNS-315L) up to version 20260205 have a stack-based buffer overflow in the UPnP_AV_Server_Path_Del function of /cgi-bin/app_mgr.cgi. Manipulation of the f_dir argument allows remote exploitation.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function().

Parse Server before versions 8.6.71 and 9.7.1-alpha.1 allows file downloads via HTTP Range requests that bypass the afterFind(Parse.File) trigger and validators when the storage adapter supports streaming (e.g., default GridFS). This grants unauthorized access to protected files.

InvoiceShelf before version 2.2.0 has an SSRF vulnerability in the PDF estimate generation module. User-supplied HTML in the Notes field is passed unsanitized to Dompdf, which fetches remote resources, enabling SSRF attacks.

In MinIO, a flaw in extractMetadataFromMime() allows any authenticated user with s3:PutObject permission to inject internal server-side encryption metadata into objects by sending crafted X-Minio-Replication-* headers on a PutObject request.

InTouch Contacts & Caller ID app version 6.38.1 allows overwriting critical internal files via the file import process, leading to arbitrary code execution or information exposure.

SourceCodester Leave Application System 1.0 has a file inclusion vulnerability via manipulation of the page argument. A remote attacker can exploit this without authentication. The exploit has been made public.

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages.

SciTokens C++ before version 1.4.1 is vulnerable to authorization bypass in path-based scope validation. The enforcer uses simple prefix comparison without path-segment boundaries, allowing a token scoped to one path to authorize access to sibling paths with the same prefix.

A vulnerability in scitokens-cpp prior to version 1.4.1 allows authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path but collapses '..' components instead of rejecting them, allowing an attacker to broaden authorization beyond the intended directory.

My Location Travel Timeline v11.80 from Squareapps LLC has an arbitrary file overwrite vulnerability during file import, which can lead to arbitrary code execution or information exposure.

PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 has an arbitrary file overwrite vulnerability during file import, which can lead to arbitrary code execution or information exposure.

A security audit identified a privilege escalation vulnerability in Operations Agent (<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.