CVE Vulnerability Catalog

The MERCURY MIPC252W IP camera firmware version 1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials.

A vulnerability in the PayRange app version 7.0.7 allows JavaScript injection into a WebView when combined with an SSL bypass. Injecting specific JavaScript function calls enables the attacker to escape the WebView sandbox and perform dangerous actions on the user's device.

CVE-2026-42486 in XAPI allows a vm-admin user to set the VM.platform:hvm_serial parameter, which should be restricted to the pool-admin role. This enables arbitrary file write in dom0, potentially leading to privilege escalation and system compromise.

CVE-2026-23562 in XAPI (XenServer API) allows a vm-admin user to configure PCI passthrough, which is normally restricted to the pool-admin role. A missing permission check in one API grants unintended access to host hardware.

In XAPI, a user with the vm-admin role can set the VM.other_config:storage_driver_domain parameter, marking a VM as the storage domain for a PBD connection. Shutting down such a VM may cause the PBD to be erroneously marked as unplugged when it is not.

Vulnerability CVE-2026-23560 in XAPI allows a vm-admin user to set the VM.other-config:is_system_domain parameter, marking a virtual machine as a system domain. Such domains are ignored and left running during host or pool operations, and may be hidden from administrative tools.

A user with the vm-admin role in XAPI can set the VBD.other_config:backend-local parameter, allowing arbitrary files in dom0 to be turned into virtual disks (VDIs) and attached to a controlled VM. This enables unauthorized read and modification of files in dom0.

When oxenstored tears down a domain, node data is cleaned up but usage counts are leaked. When the domain ID is reused, the new domain can create fewer nodes before being deemed over quota.

A vulnerability in the varstored component of the Xapi toolstack handling UEFI variables for VMs. Insufficient compiler barriers create TOCTOU issues in a shared buffer with OVMF, potentially allowing an attacker to control an index used in a jump table.

Multiple issues exist in XAPI: (1) database updates sanitize input strings but generate notifications from unsanitized input, causing the database event thread to terminate; (2) XAPI's UTF-8 encoder implements Unicode v3.0 while libraries use v3.1, leading to acceptance of invalid strings that can prevent database loading; (3) no input sanitization for Map/Set updates on database objects.

CVE-2025-27464 affects the XenBus driver for Windows, which lacks a security descriptor, allowing unprivileged users full access to its facilities.

CVE-2025-27463 affects the XenIface driver in Windows PV drivers. The lack of a security descriptor allows unprivileged users full access to this interface.

The Windows PV drivers (XenCons) lack a security descriptor, allowing unprivileged users full access to the facilities exposed by this component.

A vulnerability in Xerte Online Tools allows authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to take over the service and connect it to a remote database they control.

A vulnerability in Xerte Online Tools allows remote code execution (RCE) by changing the antivirus binary path in the server settings to a PHP interpreter. An attacker can then upload PHP data that will be executed on the server.

An SQL injection vulnerability was found in BiEticaret by Inrove Software and Internet Services due to improper neutralization of special elements in SQL commands. This allows an attacker to execute arbitrary SQL queries on the database.

A stored Cross-Site Scripting (XSS) vulnerability has been found in ValeApp by OceanicSoft Informatics Systems Ltd., due to improper input neutralization during web page generation. This issue affects all versions up to 09072026.

The Blocksy Companion plugin for WordPress is vulnerable to arbitrary file upload in versions up to 2.1.46. The flaw lies in the save_attachments function, which improperly validates file extensions, allowing double-extension files like shell.woff2.php to bypass MIME checks. This can lead to remote code execution, but exploitation requires the premium plugin with specific extensions active.

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed and relying solely on a public `form_nonce` nonce.