CVE Vulnerability Catalog

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 allows unauthenticated attackers to reduce wireless power or cause a Denial of Service (DoS) via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 allows unauthenticated attackers to create or weaken guest wireless access via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 allows unauthenticated attackers to reconfigure or disable wireless networks via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setStorageCfg function of TOTOLINK T6 allows unauthenticated attackers to alter the storage-related service state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setLanCfg function of TOTOLINK T6 allows unauthenticated attackers to alter LAN network configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

A cross-site scripting (XSS) vulnerability was found in code-projects Online Shopping System 1.0 in /offersmail.php. Manipulation of the email argument allows remote script execution in the victim's browser. The exploit is public.

In sambitraj Student Management System up to version 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, a flaw was found in the Password Handler component in file aca.sql. Manipulating the Password argument leads to cleartext storage of sensitive information. The attack can be executed remotely.

A use of default password vulnerability was found in sambitraj Student-Management-System up to commit 56ba287f. Remote exploitation is possible and the exploit is public. The project has not responded.

In sambitraj Student-Management-System up to version 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, a vulnerability was detected in the session_start function that leads to cookies without the 'httponly' flag. The attack may be launched remotely but is difficult to exploit.

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools did not check if the file path was within the workspace. Relative, absolute, or ~-expanded paths could write or delete files outside the workspace with backend user privileges. This can escalate to code execution.

An Open Redirect vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) via the Base64 return parameter. Redirect parameters accept arbitrary Base64 strings without verifying if the target is an internal URL.

In Helix Ultimate for Joomla before 2.2.10, a privileged file upload bypass via content spoofing was found. Previously only file extension and basic size were validated, allowing non-image files with raster extensions to be uploaded. Strict MIME verification and GD binary raster decoding were added to reject invalid images.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the MegaMenu layout container and Embed inputs. Unsanitized column and item configuration values stored in the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML/JS.

A missing authorization vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) in MegaMenu settings. The AJAX endpoint save-megamenu-settings fails to enforce item-level and menu-level edit permissions. An authenticated user can modify layout parameters for arbitrary menu items without proper authorization.

A broken object-level authorization vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) in blog image deletion. Blog::remove_image() checks if the user is authorized to edit the article, but does not verify if the image path belongs to that article. On Joomla 3 builds, an author can delete arbitrary files under /images/.

In Joomla extensions from miniOrange, a missing authentication check allows unauthenticated attackers to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.

A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractSingleSelectChoice (base class of DropDownChoice). The default option body is written without escaping, while other options are escaped. Applications overriding getNullValidDisplayValue() or getNullKeyDisplayValue() with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.

A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractOptions (renders option lists in Palette). Attribute names and values from getAdditionalAttributes are written without escaping. Applications overriding getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or getAdditionalAttributes with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.

In SmallRye GraphQL, the number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can send a GraphQL query with a large exponent float literal, leading to allocation of extremely large BigInteger objects, causing CPU exhaustion or OutOfMemoryError, resulting in denial of service.

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 allows unauthenticated attackers to expose WAN-side administration via a crafted POST request to /cgi-bin/cstecgi.cgi.