CVE Vulnerability Catalog

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full, allowing an attacker to read/write arbitrary files, coerce NTLMv2 authentication, or achieve remote code execution. The service runs as NT AUTHORITY\SYSTEM, and the vulnerability is fixed in BarTender 12.0.1.

OSNexus QuantaStor SDS Manager has an SQL injection vulnerability in the login endpoint. The username field is not properly sanitized, allowing an unauthenticated attacker to bypass authentication and log in as an administrator.

The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands, which will be executed with the privileges of the web server.

In the Apache Fory fory-core Java SDK before version 1.1.0, there is a deserialization of untrusted data vulnerability in the Java replace-resolve path. A remote attacker can bypass class registration, TypeChecker, and DisallowedList checks and invoke readResolve/readExternal hooks via crafted Fory serialized data.

The Neterbit NW-431F router version 20241014-IR03 and earlier contains an authentication bypass vulnerability. The router uses a weak/predictable cookie value for authentication. By modifying the cookie value (e.g., setting it to "admin"), an attacker can bypass authentication and gain unauthorized access to admin functionalities.

Tautulli versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves attacker-controlled entries from `image_hash_lookup` and replays them through server-side image fetch logic. A low-privilege guest user can seed a malicious external image URL into this lookup table and trigger server-side fetches through an unauthenticated endpoint, turning an authenticated SSRF primitive into a persistent unauthenticated SSRF gadget.

GNCC GP5 v7.1.76 uses a weak hashing algorithm to protect the root password. Attackers can perform a brute-force attack to obtain root credentials and escalate privileges.

MISP has a mass assignment vulnerability in the user edit functionality (UsersController::edit()). An authenticated attacker can modify the user ID in the request, leading to updates on another user's account.

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07 and T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via a crafted HTTP query string.

T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the 'superadmin' account.

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via a crafted request to a vulnerable CGI component.

Mobatek MobaXterm version 12.1 has a buffer overflow vulnerability in the username field of session files. A remote attacker can craft a malicious session file that, when imported and executed, triggers a buffer overflow and allows arbitrary code execution.

WordPress Hybrid Composer plugin version 1.4.6 contains an unauthenticated settings change vulnerability. An attacker can send a POST request to admin-ajax.php with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator.

PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information.

The WordPress plugin 'ad manager wd' version 1.0.11 contains an arbitrary file download vulnerability. An unauthenticated attacker can manipulate the 'path' parameter in GET requests to the edit.php endpoint with export=export_csv to read arbitrary files like wp-config.php.

Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection. This issue affects TeknoPass from 20210501 through 20260429.

The registration path /v1/account/register lacks bot mitigation mechanisms, allowing malicious automated systems to flood the database.

The /v1/Plan service uses a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.