CVE Vulnerability Catalog

In Johnson Controls FM Systems Employee before version 2025.3.1, there is an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files.

The Tenda W6-S device version 1.0.0.4(510) has a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The formwrlSSIDset function uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow.

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

Wings, the server control plane for Pterodactyl, prior to 1.12.3 allows a low-privileged user to read sensitive configuration data (token, token_id, Docker registries) via {{config.}} placeholders in egg configuration-file templates.

A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.

A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.

In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).

Deployment of the VPS.org one-click Zulip template includes a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.

Deployment of the VPS.org one-click Supabase template runs a PostgreSQL instance listening on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.

A Code Injection vulnerability in Logsign SIEM (before 6.4.115) allows code injection.

PHP Jabbers Car Rental Script before version 4.1 contains a SQL injection vulnerability in sorting parameters, allowing an unauthenticated attacker to perform SQL injection attacks.

DMS+ (Non-Mobile) by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

The ShopMonitor.io WordPress plugin before version 1.2.0 improperly restricts its email-rerouting test mode, relying on client-supplied request headers. Unauthenticated attackers can redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0. Missing file type validation combined with a publicly accessible I/O endpoint authenticated solely by static default API credentials allows unauthenticated attackers to upload executable files, leading to remote code execution.

CodeIgniter prior to 4.7.4 has a vulnerability in the is_image and mime_in upload validation rules that do not enforce a safe client filename extension. A remote attacker can upload executable content if the application preserves the client filename and stores uploads in a web-accessible script-enabled directory.

CodeIgniter from 4.3.0 through 4.7.3 has a vulnerability in the Query Builder deleteBatch() method that substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing SQL injection.

Full details and mitigation steps are currently restricted and will be published at a later date.

In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages.

Multiple router models (TR1200, TR3000, WR300, etc.) contain a command injection vulnerability in the net.set_wan interface. Attackers can execute arbitrary commands as root via crafted input.