CVE Vulnerability Catalog

Remote Code Execution (RCE) vulnerability in Sourcecodester Covid-19 Contact Tracing System 1.0. The application accepts a reverse shell (php) into the user's image, enabling RCE.

SQL Injection vulnerability in /exam/user/profile.php of kashipara Online Exam System V1.0. Remote attackers can execute arbitrary SQL commands to gain unauthorized database access via the rname, rcollage, rnumber, rgender, and rpassword parameters in a POST request.

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

CVE-2026-22785 dotyczy podatności w orval, który generuje typowo bezpieczne klienty JS (TypeScript) z specyfikacji OpenAPI v3 lub Swagger v2. W wersjach przed 7.18.0 logika generacji serwera MCP opiera się na manipulacji ciągami, co pozwala na wstrzykiwanie dowolnego kodu poprzez niewłaściwą walidację pola podsumowania.

Vulnerability in DFIR-IRIS (Iris platform) before version 2.4.24: mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths.

TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

cpp-httplib prior to version 0.30.1 contains a Denial of Service (DoS) vulnerability due to unsafe handling of compressed HTTP request bodies. The library validates payload_max_length against compressed data size but does not limit the size of decompressed data stored in memory.

A vulnerability in Envoy Gateway before versions 1.5.7 and 1.6.2 allows credential leakage via Lua scripts in EnvoyExtensionPolicy. Leaked credentials can be used to communicate with the control plane and access all secrets used by the proxy, including TLS private keys and communication credentials.

LibreChat prior to v0.8.2-rc2 has a vulnerability in the MCP stdio transport that accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.

A vulnerability in osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 allows a remote attacker to read arbitrary files from the server via ticket PDF export. The attacker can submit a ticket containing crafted rich-text HTML with PHP filter expressions that are insufficiently sanitized before being processed by the mPDF PDF generator. When the ticket is exported to PDF, the generated file can embed contents of attacker-selected files from the server filesystem as bitmap images, leading to disclosure of sensitive local files in the context of the osTicket application user.

MindsDB, platforma do budowy sztucznej inteligencji, przed wersją 25.11.1 miała podatność na nieautoryzowany atak typu path traversal w API przesyłania plików. Umożliwia to atakującemu odczyt dowolnych plików z systemu plików serwera oraz przeniesienie ich do magazynu MindsDB, co prowadzi do ujawnienia wrażliwych danych.

In DDSN Interactive Acora CMS v10.7.1, the password reset function uses a static token, allowing an attacker to reuse the same token to reset any user's password and perform a full account takeover.

An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component.

An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism.

An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file.

An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges.

W wersjach Errands przed 46.2.10 nie weryfikowane są certyfikaty TLS dla serwerów CalDAV. Może to prowadzić do potencjalnych ataków typu man-in-the-middle.

The D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition.

The D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The lack of rolling codes, message authentication, or anti-replay protection allows an attacker within RF range to record valid alarm/control frames and replay them to trigger false alarms.

Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.