CVE Vulnerability Catalog

Authentication bypass vulnerability in Stela versions prior to 1.60.1 due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these client-modifiable values to complete the login process.

The User Rights Access Manager WordPress plugin through version 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role created as a copy of the administrator role. This allows unauthenticated attackers to register an administrator-equivalent account.

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. Missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks, makes it possible for unauthenticated attackers to upload files that may be executable, leading to remote code execution.

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected.

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that validate that the user is logged in; with the default certificate, an attacker could sign JWT access tokens and bypass login. An attacker could gain administrative access and perform actions like configuring the service or requesting log collection; device credentials and customer data cannot be accessed with this vulnerability.

When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection; device credentials and customer data cannot be accessed with this vulnerability.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobrancas_geracao.php endpoint accepts POST data via extract($_REQUEST) and inserts it directly into an INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data, or delete database tables.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobranca.php endpoint accepts POST input via extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can execute arbitrary SQL to read or modify WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data.

In WeGIA prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.

In Stirling-PDF prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account.

A vulnerability was found in D-Link DIR-868L version 2.01b05. It affects the system function in the /htdocs/cgibin file of the HNAP CGI Handler component. Manipulation of the SOAPACTION argument can lead to OS command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

In Dgraph prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval.

In F´ (F Prime) from 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution.

In Redash from 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass.

In e107 CMS prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise.

In e107 CMS prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path.

In Hestia Control Panel versions 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file. A low-privileged authenticated panel user with a web domain can inject an additional PATH field and, by invoking the ordinary Search feature, execute arbitrary code as root. The vulnerability is fixed in version 1.10.5.

When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and contents of the cookie come from the peer, and the write occurs before certificate authentication completes, so a malicious or compromised server can overwrite memory past the TLS packet buffer without presenting a certificate. Only the client path is affected.