CVE Vulnerability Catalog

A missing authorization vulnerability was found in bbPress (versions up to 2.6.14), allowing exploitation of incorrectly configured access control security levels. This can be used for unauthorized actions.

The Site Management Panel (Ankara Hosting) has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. Affects versions through 15062026.

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWizardCfg function of TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via a crafted POST request to /cgi-bin/cstecgi.cgi.

In the Qute template engine (used by Quarkus), the ReflectionValueResolver component fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence template text can exploit this bypass to take control of the server by executing unauthorized commands.

Uncontrolled recursion in Samsung Open Source rlottie allows processing of serialized data with nested payloads, potentially leading to system overload or denial of service. Affects versions before 8de0d9e6ca80ffef654965505981727b9fa06a51.

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. It affects an unknown function in the file /cgi-bin/isomount_mgr.cgi of the ISO Image Handler component. Manipulation of the argument upIsoRootPath results in OS command injection. The attack can be executed remotely, and the exploit is public.

In Apache Wicket, the MetaDataHeaderItem component improperly neutralizes input during web page generation. Attribute values in <meta> and <link> tags are not properly escaped, allowing injection of additional attributes. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.

In Apache Wicket, the <wicket:label> tag is rendered without escaping, allowing HTML injection if the label comes from a model containing attacker-controlled data. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.

XSS vulnerability in Apache Wicket affects the Button component rendered as a <button> element. The constructor clears the escape-model-strings flag, so the model is not encoded when written to the element body, allowing markup injection.

XSS vulnerability in Apache Wicket affects AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel components. Displayed label values are not properly escaped, allowing an attacker to inject HTML or scripts. Affected versions: 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0.

The vulnerability in Apache Wicket concerns the CSRF protection mechanism (ResourceIsolationRequestCycleListener). The default FetchMetadataResourceIsolationPolicy incorrectly allows simple top-level navigations and same-site requests, enabling an attacker to trigger component listeners within an authenticated session. Affected versions are 9.1.0 through 9.23.0 and 10.0.0 through 10.10.0.

A vulnerability in Apache Wicket allows bypassing file size and count limits when a multipart request has already been consumed by another component. Wicket then reads uploads via HttpServletRequest#getParts() without applying per-file and file-count limits, allowing larger or more numerous files than permitted. Additionally, a part without a Content-Type header is fully read into memory, potentially causing excessive resource consumption.

A vulnerability in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The attack exploits improper validation of resource URL attributes, which are spliced into the resource lookup path without checking for path separators.

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execute in users' browsers when viewed.

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE declarations containing SYSTEM entities pointing to local files, causing the crawler to exfiltrate file contents into the searchable index.

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another. The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.