CVE Vulnerability Catalog

The Joomla extension OrdaSoft CCK before version 8.3.16 contains an unauthenticated SQL injection vulnerability. The order column for records was user provided and not properly validated, leading to a SQL injection vector.

Northstar (quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary system commands via CREATE ALIAS (pre-auth RCE).

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

A vulnerability has been detected in Totolink A3002MU version 1.0.0-B20230403.1455. It affects an unknown function in the file /boafrm/formIpQoS of the QoS Rule Handler component. Manipulation of the addQos/comment/entry_name arguments leads to a stack-based buffer overflow. The attack can be performed remotely, and the exploit has been publicly disclosed.

A weakness has been identified in Totolink A3002MU version 1.0.0-B20230403.1455. It affects the function sub_40FCFC in the file /bin/boa of the Authentication Check component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely, and the exploit has been made publicly available.

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.

YAML before version 1.30 for Perl allows a loaded document to trigger the DESTROY method of arbitrary classes. The perl/hash:Class tag blesses a hash into the class it names, and Perl calls DESTROY when it goes out of scope.

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, which the victim's later genuine external login then signs into.

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a blind SQL injection vulnerability. An attacker can exploit this flaw to manipulate database queries without knowing the database structure.

A code injection vulnerability was found in InternLM MindSearch 0.1.0 in the ExecutionAction.run function in mindsearch/agent/graph.py. The attack can be launched remotely, and exploit details have been publicly disclosed.

Missing authentication for critical function in the ait-server telemetry and command broker in NASA-AMMOS AIT-Core through 3.1.1. An unauthenticated remote attacker with network access to the ZeroMQ message bus can inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the bus. The ZeroMQ broker binds XSUB and XPUB sockets to all interfaces by default without authentication.

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. An attacker could present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path.

The Beaver Builder Page Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to arbitrary shortcode execution. This is due to insufficient validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires a page with the Sidebar module containing a widget that displays attacker-controlled text, such as the Recent Comments widget with approved comments.

The VikAppointments Services Booking Calendar plugin for WordPress up to version 1.2.21 is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function. This allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution (e.g., by deleting wp-config.php). Exploitation requires at least one File-type custom field published on the confirmation page.

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files and passes them to the ebook-convert program from Calibre. This allows executable code in .recipe or .downloaded_recipe files.