CVE Vulnerability Catalog

A vulnerability in D-Link DIR-1253 version 1.0.1.250923.142435 allows privilege escalation via the etc/shadow file. An attacker can exploit this flaw to gain unauthorized access to user accounts.

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint.

An out-of-bounds read vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during CIP message parsing. An attacker can send a valid ENIP SendRRData frame with a very short CIP payload where the path_size field claims more path words than available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary check, it reads beyond the end of the stack receive buffer.

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

An incorrect access control vulnerability was found in OpENer 2.3.0 (commit 76b95cf) during encapsulation session handling. The server only checks if a session handle exists in the global list but does not verify if it belongs to the specific TCP connection making the request. This allows an attacker to hijack another client's session and bypass access controls.

An out-of-bounds read vulnerability was found in EIPStackGroup OpENer version 2.3.0 (commit 76b95cf) in the Connection Manager handling of ForwardOpen requests. The issue occurs when processing short malformed packets, where the parser continues reading fields even when request data is insufficient.

In OpENer 2.3.0 (commit 76b95cf) when parsing CIP packets, the length parameter is inconsistently typed across the call stack. An int length is passed to a function expecting EipInt16, allowing crafted packets to cause overflow or negative values. This bypasses bounds checks and leads to a stack buffer overflow in DecodePaddedEPath.

In ChurchCRM prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist fails to block standard .php files, allowing direct code execution via HTTP after extraction in the web root.

A remote code execution vulnerability was identified in the ServiceNow AI platform, potentially allowing an unauthenticated user to execute code under certain circumstances. The issue has been addressed with security updates for hosted and self-hosted instances.

The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 derives the session-cookie signing key from the non-cryptographic Math.random() generator and discloses its outputs to unauthenticated clients during login. A remote attacker can collect a few login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

A signed integer overflow vulnerability in Storable versions before 3.41 for Perl occurs when deserializing a crafted SX_HOOK record. The retrieve_hook_common function reads a signed 32-bit item count, and adding one to I32_MAX wraps it to a negative value.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. Overflow of a 16-bit field truncates the match decision table, leading to false positive and false negative matches.

A remote code execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. An unauthenticated attacker can upload arbitrary PHP files by providing a base64-encoded payload and execute arbitrary code on the server. The issue has been fixed in a patch released in April 2026.

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint. Attackers can execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Lack of input sanitization leads to direct command execution via passthru() with root privileges.

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint. The flaw is a double-evaluation issue: escapeshellarg() is applied to the host parameter, but the system wrapper retrieves the decoded value from argv and passes it to a second shell_exec() call without sanitization.

An integer overflow vulnerability has been found in the do_sub() routine in the "builtin.c" file of gawk. It affects 32-bit builds of gawk versions 5.4.0 and below, potentially allowing heap metadata overwrite and program crash.

An integer overflow vulnerability has been found in the "builtin.c" file of gawk versions 5.4.0 and below. This issue may lead to memory exhaustion on the hosting operating system and could allow an attacker to overwrite gawk heap metadata and objects with controlled bytes.

Mura CMS versions prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is in the endpoint “/index.cfm/_api/json/v1/default”, where the “method” parameter in POST requests is not properly validated or sanitized before being processed by the ColdFusion engine. A remote attacker can exploit this to inject and execute arbitrary CFML expressions and instantiate malicious Java objects, compromising system security.

A missing authorization vulnerability in the repository creation functionality of Google Cloud BigQuery, Dataform, and Colab Enterprise allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The vulnerability affects versions between October 2025 and May 10, 2026.

The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.