CVE Vulnerability Catalog

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.

Dell SmartFabric OS10 Software versions prior to 10.5.6.14 contain an OS command injection vulnerability. A high privileged attacker with remote access could exploit this to execute commands.

In Tenda HG10 (version 300001138), the function formWlanSetup in the file /boaform/formWlanSetup of the Boa Web Server component has a buffer overflow caused by manipulation of the ssid argument. Remote exploitation is possible, and the exploit is publicly available.

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

The Enfold theme by Kriesi contains a reflected Cross-site Scripting vulnerability in versions up to and including 8.0. It stems from improper neutralization of input during web page generation.

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload and treats its Subject DN as the authenticated identity. The certificate is decoded but its signature is never verified and its issuer chain is never validated against any trust store. An attacker who can publish to the MQTT broker can mint a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op to gain full management access over MQTT.

In Eclipse Arrowhead versions from 5.0.0 to 5.2.1, the management-authorization gate protecting every /…/mgmt/… REST endpoint decides whether to apply its check by calling request.getRequestURL().toString().contains("/mgmt/"). Tomcat returns getRequestURL() un-decoded, while Spring MVC's DispatcherServlet routes on the decoded path. Requesting /serviceregistry/%6Dgmt/systems (%6D == m) fails the substring check but is decoded to /serviceregistry/mgmt/systems and dispatched to the management controller. Any authenticated system can reach every management operation, including creating sysop accounts, leading to full administrative takeover of the local cloud.

A remote code execution issue exists when parsing DOE files, allowing a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this, a legitimate user must visit a malicious page or open a malicious file.

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.

A vulnerability in the RBAC mechanism of SYS600 allows users with access to engineering tools to elevate their privileges to administrator level on the underlying Windows host, granting full control over the machine.

A vulnerability in SYS600 allows any user authenticated to the operating system of the hosting server to read and modify application objects without being authenticated to the SYS600 system itself.

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user's machine. To exploit this issue attackers would need a way to create arbitrary log messages, achievable through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker.

SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function, which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key). Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator, any user can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic and forging of certificates trusted by clients that imported SiYuan's CA.

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

n8n versions before 2.36.2 have a missing per-project authorization vulnerability in the Insights API routes, allowing authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive information.

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation checks the uri property while the HTTP client uses the url property, allowing bypass and access to internal addresses.

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing the composer to read a local file accessible to the n8n process or fetch an internal URL (SSRF) and attach the result to the outgoing message.