CVE Vulnerability Catalog

A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.php. Executing manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.

In code-projects Online Hotel Reservation System 1.0, a vulnerability exists in an unknown function of the file /admin/addgalleryexec.php. Manipulation of the argument image results in unrestricted upload. The attack can be carried out remotely, and the exploit is now public.

Wtyczka OrderConvo dla WooCommerce przed wersją 14 nie weryfikuje ścieżek plików do pobrania, co może umożliwić nieautoryzowanemu atakującemu odczytanie/pobranie dowolnych plików za pomocą ataku typu path traversal.

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become unresponsive by providing crafted input.

A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0. This affects an unknown function of the file /admin/addexec.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec.php. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

W systemie zarządzania wizytami w apartamentach Campcodes Online w wersji 1.0 odkryto lukę bezpieczeństwa. Problem dotyczy nieznanej funkcji w pliku /bwdates-reports-details.php, gdzie manipulacja argumentami fromdate/todate prowadzi do wstrzykiwania SQL.

Zidentyfikowano podatność w systemie zarządzania wizytami w apartamentach Campcodes Online w wersji 1.0. Manipulacja argumentem searchdata w pliku /search-visitor.php prowadzi do wstrzyknięcia SQL, co może być zainicjowane zdalnie.

W systemie zarządzania wizytami w apartamentach Campcodes Online w wersji 1.0 zidentyfikowano podatność. Problem dotyczy nieznanego przetwarzania pliku /index.php, gdzie manipulacja argumentem Username może prowadzić do wstrzyknięcia SQL. Atak może być przeprowadzony zdalnie.

W kodzie projektu Student Crud Operation do wersji 3.3 odkryto podatność, która dotyczy funkcji move_uploaded_file w pliku add.php komponentu Strona Dodawania Studenta/Edytowania Studenta. Manipulacja tą funkcją prowadzi do nieograniczonego przesyłania plików.

Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.

In KUNO CMS prior to version 1.3.15, an SSRF vulnerability exists in the Media module of the admin panel. A logged-in administrator can upload a crafted SVG file with an external image reference, causing the server to initiate an outgoing connection to an arbitrary external URL. This can lead to information disclosure or internal network probing. Version 1.3.15 contains a fix.

The YoSmart YoLink API through 2025-10-02 uses an endpoint URL derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.

The YoSmart YoLink application (through 2025-10-02) has session tokens with unexpectedly long lifetimes.

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials. The lack of encryption exposes sensitive information.

The YoSmart YoLink MQTT broker through 2025-10-02 does not enforce sufficient authorization controls to prevent cross-account attacks, allowing an attacker to remotely operate affected devices if the attacker obtains the associated device IDs. Because YoLink device IDs are predictable, an attacker can exploit this to gain full control over any other YoLink user's devices.

Components of the YoSmart YoLink ecosystem through 2025-10-02 leverage unencrypted MQTT to communicate over the internet. An attacker with the ability to monitor network traffic could therefore obtain sensitive information or tamper with the traffic to control affected devices. This affects YoLink Hub 0382, YoLink Mobile Application 1.40.41, and YoLink MQTT Broker. NOTE: The vendor states that the vulnerability described (related to insecure transmission) only impacts the legacy mobile application logic, not the Hub hardware or firmware.

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can read a boot log that includes network access credentials.

A vulnerability in OpenSSH before version 10.1 allows the null character ('\0') in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

A vulnerability in OpenSSH before version 10.1 allows control characters in usernames from potentially untrusted sources, such as the command line or %-sequence expansion in configuration files. This can lead to code execution when a ProxyCommand is used.