CVE Vulnerability Catalog

The Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface. Unauthenticated attackers can access internal application pages such as index.zhtml, point.zhtml, and log.shtml without any session management or server-side authentication, enabling full administrative read and write access.

The Taiko AG1000-01A SMS Alert Gateway versions Rev 7.3 and Rev 8 contain hard-coded credentials in the web interface. Authentication is implemented entirely in client-side JavaScript, allowing credentials to be read from the page source.

Altium Enterprise Server Viewer has a path traversal vulnerability in the StorageController component. An authenticated user can read arbitrary files from the server filesystem, including the configuration file with database credentials and signing keys.

Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.

The Gift Cards For WooCommerce Pro plugin for WordPress (versions up to and including 4.2.6) contains an unrestricted upload of files with dangerous types vulnerability. This allows an attacker to upload malicious files to the server.

In Frappe Learning Management System (LMS) versions 2.50.0 and below, a user with course editing role can upload a SCORM ZIP package to write files outside the intended directory. Fixed in version 2.50.1.

A vulnerability in XWiki Platform versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17. The POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki.

A vulnerability in XWiki Platform allows reading configuration files by manipulating the resource parameter in ssx and jsx endpoints, leading to Path Traversal. Affects versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17.

In Cisco Secure Workload, a vulnerability in the access validation of internal REST APIs could allow an unauthenticated, remote attacker to access site resources with Site Admin privileges. This is due to insufficient validation and authentication when accessing REST API endpoints. An attacker can send a crafted API request to a vulnerable endpoint to read sensitive information and make configuration changes across tenant boundaries.

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

The phoenix_storybook library from version 0.5.0 before 1.1.0 contains a code injection vulnerability allowing unauthenticated remote code execution. The vulnerability is in the psb-assign WebSocket event handler, where attribute names and values from unauthenticated clients are stored without sanitization and then interpolated into a HEEx template without proper escaping. This allows injection of an Elixir expression that is compiled and executed on the server.

A code injection vulnerability in Meona Client Launcher and Server components allows code execution on other users' systems. Affects versions up to 19.06.2020 15:11:49 (Client Launcher) and up to 2025.04 5+323020 (Server).

NLnet Labs Unbound up to version 1.25.0 is vulnerable to cache poisoning via promiscuous records in the authority section. An attacker can inject non-NS records (e.g., MX) along with address records that Unbound caches, leading to cache poisoning. Version 1.25.1 includes a fix that disregards address records from the additional section if they are not explicitly relevant to NS records.

NLnet Labs Unbound from version 1.19.1 to 1.25.0 has a vulnerability in the DNSSEC validator due to a struct-assignment bug during deep copy, leading to a dangling pointer and potential code execution.

SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.

SQL Injection vulnerability in NextGEN Gallery prior to version 4.2.1. An authenticated attacker with 'NextGEN Gallery overview' capability can inject arbitrary SQL into the ORDER BY clause via the 'orderby' parameter in REST API endpoints. Root cause is insufficient sanitization in '_clean_column()' using a blacklist approach.

The Boost plugin for WordPress up to version 2.0.3 is vulnerable to PHP Object Injection via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

The Easy Elements for Elementor plugin for WordPress up to version 1.4.4 allows unauthenticated attackers to register with the administrator role. The 'easyel_handle_register' function does not restrict user roles during registration.