CVE Vulnerability Catalog

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. An authenticated administrator can submit a value containing shell metacharacters, leading to arbitrary OS command execution with root privileges.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user-supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.

A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.

LMCache multiprocess mode opens an unauthenticated ZeroMQ ROUTER for worker registration and KV cache sharing. Messages are msgpack, and extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) executes code as the LMCache user. Official containers run as root. The transport binds to localhost unless --host is set for multi-node deployments.

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 allows attackers to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated, resulting in the webserver accepting any valid JWT.

This vulnerability in the ERP system is due to unsafe deserialization of user-controlled data in the affected functionality. An unauthenticated remote attacker could exploit this by supplying specially crafted data to the vulnerable functionality.

This vulnerability in the ERP system is due to insufficient validation and parameterization of user-supplied input in an API endpoint. An unauthenticated remote attacker could exploit this by supplying specially crafted input to the vulnerable endpoint.

This vulnerability in the ERP system is due to improper validation of payment callback parameters and inadequate authentication controls in an API endpoint. An unauthenticated remote attacker could exploit this by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification.

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache to write past it and into the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed.

Joomla Extension - OrdaSoft Simple Membership before 7.4.0 has an unauthenticated SQL injection vulnerability. The site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control. The handler reads a login parameter through Joomla's generic non-sanitizing input filter, which strips HTML/script tags but not quotes or SQL syntax, and concatenates it directly into a query without escaping or parameterization.

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.

VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host.

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials.

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.