CVE Vulnerability Catalog

A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 in the sub_425964 function of the /goform/SetOnlineDevName file. An attacker can remotely exploit this flaw to execute arbitrary code.

A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 within the sub_424CE0 function of the /goform/setMacFilterCfg file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.

A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EEE0 function of the /goform/SetStaticRouteCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a device crash.

In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.

A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EA38 function of the /goform/SetVirtualServerCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a denial of service.

A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.05 in the sub_4418CC function of the /goform/SetNetControlList file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.

ktransformers through version 0.6.3 (fixed in commit def0f93) contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

Vulnerability in RT (Request Tracker) before versions 5.0.10 and 6.0.3 in the REST 2.0 API allows a privileged (non-admin) user to obtain credentials of other users, including admins, and use them to read data via feeds. The request rotates the credentials, invalidating existing feed URLs.

Vulnerability in dotCMS (versions 21.02 through 26.06.22-03) in ToolGroupResource and RoleAjax REST/DWR endpoints. A low-privileged authenticated backend user can self-assign the CMS Administrator role and achieve remote code execution via a crafted OSGi bundle upload.

A vulnerability in the Net::DNS library for Perl (versions up to 1.55) allows remote code execution via a crafted EDNS EXTENDED ERROR record. The _decompose function improperly handles backtick characters (`), enabling system command injection.

The Joomla extension Page Builder CK below version 3.6.2 does not properly apply access control to frontend page list views. An authenticated user can gain unauthorized access to page lists.

The Joomla extension JDownloads versions below 4.1.6 contains an unauthenticated arbitrary file upload vulnerability. This allows a remote attacker to upload any file without authentication, leading to full remote code execution (RCE).

The Joomla extension Gridbox versions below 1.6.0 contains an authentication bypass vulnerability. An attacker can gain full administrative access without providing valid credentials.

The Joomla extension DJ-Classifieds versions below 3.11.2 is vulnerable to unauthenticated arbitrary file upload. An attacker without authentication can upload any file, leading to full remote code execution (RCE).

The Joomla extension JMedia versions below 1.6.0 is vulnerable to stored cross-site scripting (XSS). Unsanitized SVG uploads served without the nosniff header allow an attacker to inject malicious scripts that execute in other users' browsers.

The Joomla extension JMedia versions below 1.6.0 is vulnerable to authenticated arbitrary file upload. An authenticated attacker can upload executable files (including with polyglot filenames), and chmod does not strip execute bits, leading to remote code execution (RCE).

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form. An unauthenticated attacker can execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover.

Vulnerability in Network-AI (TypeScript/Node.js) before version 5.9.1 allows bypassing the shell command allowlist. An attacker can execute arbitrary commands by injecting special characters (e.g., `;`).

xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.