CVE Vulnerability Catalog

Tenda 5G03 version V05.03.02.04 (version 1.0) is vulnerable to command injection in the action_ims_on_with_apn function via the ims_apn parameter.

Tenda 5G03 version 5.03.02.04 (version 1.0) is vulnerable to command injection in the action_dial_call function via the dialNumber parameter.

Tenda 5G03 version 5.03.02.04 (version 1.0) is vulnerable to command injection in the action_radio_on_with_ia_apn function via the ia parameter.

Tenda 5G03 version V05.03.02.04 (version 1.0) is vulnerable to command injection in the action_set_rat_mode function via the ratMode parameter.

Tenda 5G03 version 5.03.02.04 (version 1.0) is vulnerable to command injection in the action_set_volume function via the volume parameter.

Tenda 5G03 version V05.03.02.04 (version 1.0) is vulnerable to command injection in the action_unlock_sim function via the pin parameter.

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint.

Version 4.0.409 of the remotion-dev remotion library was found to contain an arbitrary file write vulnerability.

Version 4.0.409 of the remotion-dev remotion library has a vulnerability that allows for remote code execution (RCE).

Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

CVE-2026-52704 describes an improper control of code generation vulnerability in WooCommerce PDF Invoice Builder, allowing for remote code inclusion. This issue affects versions from n/a through 2.0.8.

The WordPress Plugin Baggage Freight Shipping Australia version 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions, enabling remote code execution.

Responsive FileManager allows an unauthenticated attacker to upload files of any type and extension without restriction using the dialog.php endpoint, leading to Remote Code Execution.

CVE-2026-49757 is an authentication bypass vulnerability in AshAuthentication that allows local user account takeover via OAuth2/OIDC sign-in. The issue arises from using the email address as a unique identifier instead of the iss/sub combination from OpenID Connect.

The WP MAPS PRO WordPress plugin before version 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.

The GD library for Perl before version 2.86 has an OS command injection and file overwrite vulnerability in the _make_filehandle function. It opens a filename argument with Perl's 2-arg open(), which interprets prefixes like '| cmd' as a pipe, allowing arbitrary command execution or file overwrite.

Nefteprodukttekhnika BUK TS-G Gas Station Automation System versions 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module.

Model Context Protocol (MCP) before version 0.25.0 lacked Origin header validation to prevent DNS rebinding attacks. Version 0.25.0 introduces the --allowed-hosts flag, which defaults to '*' and warns about potential vulnerabilities.

State mutation vulnerability in OpenClaw before 2026.5.27 in node pairing reconnection logic. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.

ApostropheCMS is a Node.js content management system that, in versions up to 4.30.0, allows unauthorized modifications to object prototypes by authenticated editors. The use of the `$pullAll` operator enables writing arbitrary values to `Object.prototype`, leading to authorization bypass on all REST API endpoints.