CVE Vulnerability Catalog

A vulnerability was identified in Webkul Bagisto up to 2.4.4 in the Customer Item Deletion Endpoint component. The manipulation leads to improper access controls. The attack can be launched remotely, and the exploit is publicly available. The vendor confirms that the issues are already known and partially addressed.

A vulnerability was determined in Webkul Bagisto up to 2.4.4. The issue affects an unknown function in /admin/customers/login-as-customer/ of the Admin Customer Impersonation Feature. Manipulation of the ID argument causes authorization bypass. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

In Akaunting versions <= 3.1.21, low-privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges. This vulnerability is caused by a flaw in the UpdateUser job, which processes user-supplied role assignments via an unconditional roles()->sync() call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission-gated and are not affected by this issue. This vulnerability has been remediated in v3.2.0.

A race condition vulnerability in the event notification functionality of KUNBUS piControl version 2.6.2. A local authenticated attacker can corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory by issuing concurrent crafted requests from multiple threads through the piControl character device.

In KUNBUS piControl version 2.6.2, a CWE-362 race condition vulnerability exists in the configuration and process-image management functionality. It allows a local authenticated attacker to trigger use-after-free and invalid pointer dereferences on kernel configuration objects by sending concurrent crafted requests through the piControl character device, leading to kernel memory corruption and denial of service.

In KUNBUS piControl version 2.6.2, a CWE-787 out-of-bounds write vulnerability exists in the process-image management functionality. It allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the process-image buffer and corrupt adjacent kernel memory, by supplying crafted device configuration data and input through the piControl character device, leading to kernel memory corruption and denial of service.

This CVE was rejected as a duplicate of CVE-2026-4890. No further vulnerability details are available.

Datavane TIS v5.0.0 contains an XML External Entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration. The vulnerability arises from processing XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document with an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files, including configuration files and Derby database credentials.

A flaw in Samba's CTDB, the clustered database service, involves insufficient integrity validation of received CTDB protocol packets. A remote attacker with access to the CTDB private network can trigger denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

A path-traversal vulnerability in the logback-classic module (Java) by QOS.CH Sarl. An MDC-based discriminator value flows unsanitized into a nested FileAppender path, allowing an attacker who influences that MDC value (e.g., via an HTTP header) to create and append log files outside the intended directory. Affects versions from 0.9.14 through 1.6.2.

A flaw in Undertow, an HTTP server, in its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers, leading to truncation into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

The JSON plugin in Apache Struts has an uncontrolled resource consumption vulnerability. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. Affected versions: Apache Struts from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

A flaw in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.

An authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows exploitation of trusted identifiers. Affects versions from 20251127 before 20260204.

Use of hard-coded credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, because the employee save controller falls back to the literal password "changeme" and the onboarding form provides no password field.

A vulnerability in TRENDnet TEW-816DRM (version GURNC4.OT182B-C-TN-R1B028-US.EN) affects an unknown function in the file /etc/bftpd.conf of the bftpd component. Manipulation of the argument USERLIMIT_GLOBAL results in allocation of resources. The attack can be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

A security flaw in wvp-GB28181-pro version 2.7.4-20260107 affects unknown code in the file LogController.java of the Log File Download Endpoint. Manipulation of the argument fileName results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability in wvp-GB28181-pro version 2.7.4-20260107 affects an unknown part of the file PlayController.java of the Snapshot Endpoint. Manipulation of the arguments deviceId/channelId leads to path traversal. The attack can be initiated remotely. The exploit is publicly available and might be used.

A path traversal vulnerability was found in alldatacenter alldata up to 0.6.8, affecting the FileInputStream function in /admin/controller/JobLogController.java of the logDetailCat Endpoint. Manipulation of the executorAddress argument allows remote attacks. The exploit has been published and may be used.

In Devolutions PowerShell Universal version 2026.2.3 and earlier, a code injection vulnerability exists in the settings feature. An authenticated user with settings management permission can execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.