CVE Vulnerability Catalog

Fess up to version 15.5.1 is vulnerable to code injection in the JSP File Handler component. The update function in AdminDesignAction.java does not sanitize the 'content' argument, allowing remote code injection. Exploit is public.

A vulnerability in Kdenlive before version 26.04.1 allows dangerous proxy parameters when opening an attacker-controlled project file.

Hex-Rays IDA Pro versions 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), allowing attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.

In aandrew-me tgpt up to version 2.11.1 on Linux/macOS, a command injection vulnerability exists in the helper.Update function of the helper.go file in the Update Handler component. Local access is required, and the exploit has been publicly disclosed.

JeecgBoot up to version 3.9.1 contains a Cross-Site Scripting vulnerability in the SVG file handler component. An unknown function in CommonController.java allows remote script injection. The exploit is publicly available.

osTicket up to version 1.18.3 has a Cross-Site Request Forgery (CSRF) vulnerability in the file include/class.dispatcher.php within the Dispatcher component. Manipulation of the _method argument leads to CSRF. Remote exploitation is possible, and the exploit has been publicly disclosed. The project was informed but has not reacted.

In apko prior to version 1.2.7, the DiscoverKeys function in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g., EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys.

Vulnerability in Quarkus OpenAPI Generator before versions 2.11.1-lts, 2.16.0-lts, and 2.17.0, where the generated authentication filter matches OpenAPI path templates too broadly. This causes bearer tokens, API keys, or credentials to be sent to unintended endpoints.

The Net::IMAP library in Ruby before versions 0.4.24, 0.5.14, and 0.6.4 is vulnerable to CRLF injection / IMAP command injection via symbol arguments passed to IMAP commands.

In Net::IMAP for Ruby (versions 0.4.0 to before 0.4.24, 0.5.0 to before 0.5.14, 0.6.0 to before 0.6.4), when authenticating with SCRAM-SHA1 or SCRAM-SHA256, a hostile server can perform a computational denial-of-service attack by sending a large iteration count value.

A weakness has been identified in Akaunting 3.1.21. The component Invoice PDF Rendering in file config/dompdf.php is affected. Manipulation can lead to server-side request forgery (SSRF). The attack may be launched remotely. The exploit has been made public and could be used. The vendor did not respond.

An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the wzdap function of /cgi-bin/adm.cgi. Manipulating arguments EncrypType/wl_Pass allows remote command execution. The exploit has been published.

An OS command injection vulnerability was identified in Wavlink NU516U1 M16U1_V240425 in the wifi_region function of /cgi-bin/adm.cgi. Manipulating arguments skiplist1/skiplist2 allows remote command execution. The exploit is publicly available.

An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the wan function of /cgi-bin/adm.cgi. Manipulating arguments ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway allows remote command execution. The exploit has been disclosed.

A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The function wzdrepeater in the file /cgi-bin/adm.cgi is affected by OS command injection via manipulation of arguments wlan_bssid, sel_Automode, or sel_EncrypTyp. The attack can be launched remotely and the exploit has been made public.

An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the change_wifi_password function of /cgi-bin/adm.cgi. Manipulating arguments wl_channel, wl_Pass, EncrypType allows remote command execution. The exploit has been disclosed.

The Activity Logs plugin for WordPress up to version 3.3.6 has a logic flaw in the verifyAuthorization method that bypasses Bearer token validation. Unauthenticated attackers can access the REST API endpoint and retrieve all plugin configuration options, including the site API key.

Open5GS versions up to 2.7.7 contain an out-of-bounds read vulnerability in the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c in the NF component. An attacker can remotely manipulate data, leading to out-of-bounds read.

In Open5GS up to version 2.7.7, there is a vulnerability in the _gtpv1_u_recv_cb function of src/upf/gtp-path.c in the UPF component. Manipulation leads to resource exhaustion. The attack can be performed remotely. The project has not responded to the report.

A vulnerability in UGREEN CM933 version 1.1.59.4319 involves missing authentication in the administrative interface. The attack requires local network access. The vendor confirmed the issue and plans a fix in late April.