CVE Vulnerability Catalog

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.

A vulnerability in the Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router allows a remote attacker to obtain sensitive information. The issue affects version v1.3.241114.024540 and earlier.

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0.

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability.

Nginx UI from 2.5.0 until 2.6.0 performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client can consume temporary filesystem capacity, disk I/O, and request-processing resources before rejection. This is fixed in version 2.6.0.

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//". Combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, an authenticated attacker can upload a malicious ZIP archive to overwrite arbitrary files, leading to admin account takeover and remote code execution.

The Voux WordPress theme (thevoux-wp) by Fuelthemes contains an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, allowing PHP Local File Inclusion. This issue affects The Voux versions up to and including 6.9.5.

The Pond WordPress plugin (pond) by SpabRice contains an Improper Neutralization of Input During Web Page Generation vulnerability, allowing Reflected XSS. This issue affects Pond versions up to and including 2.6.1.

The ColorFolio WordPress theme (colorit) by BuddhaThemes contains a Deserialization of Untrusted Data vulnerability, allowing Object Injection. This issue affects ColorFolio versions up to and including 1.3.

The Neo | Barber Shop WordPress theme (neocut) by BuddhaThemes contains a Deserialization of Untrusted Data vulnerability, allowing Object Injection. This issue affects Neo | Barber Shop versions up to and including 3.5.

The Education Center WordPress theme (education) by ThemeREX contains an Improper Neutralization of Input During Web Page Generation vulnerability, allowing Reflected XSS. This issue affects Education Center versions up to and including 3.6.12.

The Dashboard Notes WordPress plugin (dashboard-notes) by MIGHTYminnow contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects Dashboard Notes versions up to and including 1.0.3.