CVE Vulnerability Catalog

The Joomla extension iCagenda before version 4.0.0-4.0.11 contains an unauthenticated SQL injection vulnerability in the mod_icagenda_calendar module. It is reachable via com_ajax without requiring a session, token, or account.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability. An unauthenticated attacker can submit crafted prompts to the POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on Python code without sandboxing.

mcp-memory-service before version 10.67.1 serves all HTTP routes under /api/documents/* without any authentication dependency, even when configured with an API key or OAuth. An unauthenticated attacker can upload, retrieve, and permanently delete data from the memory store.

erlang_quic before version 1.4.4 did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, making verification ineffective.

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the OS, allowing arbitrary command execution with root privileges.

Emlog version 2.6.26 and earlier allows unauthenticated reinstallation (action=reinstall) in install.php, which skips the already-installed check. An attacker can overwrite config.php and create a new administrator account.

Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints. The `nodeId` parameter is unsanitized and concatenated into SQL queries, allowing attackers to execute arbitrary SQL, including reading, modifying, and deleting data from the PostgreSQL database. SQL errors are reflected in XML messages, enabling data exfiltration.

A command injection vulnerability in Security Center allows a remote, unauthenticated attacker to execute arbitrary commands on the underlying operating system with the privileges of the service account.

An authenticated command injection vulnerability in Security Center related to file upload processing allows an attacker to execute arbitrary commands on the underlying operating system by uploading a specially crafted file.

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

Use of hard-coded credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL MATCH/search statement while escaping only the double-quote character and not the single quote. A single quote in the client keyword (first-order, reachable by an anonymous or RoleReader user on the publish surface) or in stored document metadata (second-order) breaks out of the string literal. Because the query runs on the main read-write siyuan.db handle via a statement-stacking-capable driver, an attacker can execute arbitrary SQL, enabling cross-notebook read and write. Fixed in v3.7.4.

The Wishlist Member plugin for WordPress up to version 3.34.1 is vulnerable to account takeover due to insufficient verification of data authenticity. The wpm_register() function validates the registration cookie only against the GET reg parameter while accepting POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a temporary or incomplete registrant bound to the current registration transaction. This allows unauthenticated attackers to take over any existing WordPress account, including administrator accounts, by supplying an arbitrary user's numeric ID as the mergewith value, causing wp_update_user() to overwrite the target account's username, password, email address, first name, and last name with attacker-controlled values, while WordPress password and email change notification emails are explicitly suppressed.

OpenChoreo prior to 1.0.2 and 1.1.2 served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments.

OpenChoreo prior to 1.0.3, 1.1.3, and 1.2.0-rc.2 exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected data planes.

FreePBX prior to 17.0.9 has a vulnerability in the UCP Node server on ports 8001 and 8003, where the checkAuth middleware is applied only to the default Socket.IO namespace. An unauthenticated client can connect to custom namespaces and send crafted event values with CR/LF, allowing arbitrary commands to execute as the asterisk service user.