CVE Vulnerability Catalog

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.

Dbit WIFI4 N300 devices version 1.0.0 allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser.

Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this vulnerability to escalate privileges and gain root-level access on cluster nodes.

Dell Container Storage Modules prior to version 1.18.0 contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability to elevate privileges.

Dell Container Storage Modules (CSM) prior to v1.18.0 contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could exploit this vulnerability to gain unauthorized access to storage backend administrator credentials for all registered storage arrays.

Dell Container Storage Modules prior to version 1.18.0 contains a Use of Hard-coded Credentials vulnerability in CSM Authorization. An unauthenticated attacker with remote access could exploit this vulnerability to elevate privileges.

Dell Container Storage Modules prior to version 1.18.0 contains a Use of Hard-coded Credentials vulnerability in csm-docs. An unauthenticated attacker with remote access could exploit this vulnerability to disclose information.

MsQuic prior to versions 2.4.20, 2.5.11, and 2.6.1 contains a vulnerability where clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certificate matches the intended target server hostname. An on-path attacker can present a certificate that does not match the intended hostname and spoof the server in a man-in-the-middle attack. The Schannel backend is not affected.

Microsoft UFO prior to version 3.0.9 contains a command injection vulnerability in the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py. The key_code parameter is passed to `adb shell input keyevent`, and the adb client joins arguments into a remote command string, allowing an authenticated Mobile MCP caller to execute additional commands as the Android shell user on an authorized connected device. This requires a valid UFO_MCP_API_KEY, adb on the host, and a reachable authorized device.

Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 contains an OS command injection vulnerability in the shell-based temporary-file cleanup instructions. An attacker who supplies a crafted Swagger/OpenAPI document can execute arbitrary commands on a developer's machine when a user invokes the generator.

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.

In the Linux kernel RDMA/rxe subsystem, mr_check_range() has an integer overflow vulnerability that allows a remote unauthenticated client to bypass memory range validation and trigger out-of-bounds access, causing a kernel oops. The fix rewrites the check in an overflow-safe form, returning -EINVAL for crafted requests.

In the Linux kernel, the RDMA/siw driver has an out-of-bounds (OOB) write vulnerability caused by improper length limiting of fragmented header copies. The fix uses the number of already received header bytes to calculate the next copy length.

Unauthenticated SQL Injection vulnerability in ARMember Premium versions up to 7.8. An attacker without authentication can manipulate database queries.

Unauthenticated SQL Injection vulnerability in Porto Theme - Functionality versions up to 3.9.3. An attacker can execute unauthorized database queries.