CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 (all versions < V2.16.0). The upgrade-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 (all versions < V2.16.0). The install-app URL parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.
A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The software-upgrade Url parameter in the web interface is vulnerable to command injection due to missing server side input sanitation.
Zidentyfikowano podatność w urządzeniach SIMATIC CN 4100 (wszystkie wersje < V2.5) związaną z niewłaściwymi kontrolami dostępu w plikach konfiguracyjnych, co prowadzi do eskalacji uprawnień. Atakujący mógłby uzyskać dostęp administratora, co skutkuje pełną kontrolą nad urządzeniem.
Due to a programming error in function module and report, the IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Wykryto podatność w kontrolerze stref przechowywania ShareFile zarządzanym przez klienta, która, jeśli zostanie wykorzystana, może umożliwić nieautoryzowanemu atakującemu zdalne przejęcie kontroli nad tym kontrolerem.
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain classes that cannot be deserialized, which could allow an attacker to remotely execute arbitrary code.
A stack overflow was discovered in the page parameter in the fromSetIpBind function in Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408).
A stack overflow was discovered in the deviceId parameter in the saveParentControlInfo function in Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47.
Tenda AC1206 V15.03.06.23 and AC10 V15.03.06.47 were discovered to contain a stack overflow in the wpapsk_crypto parameter in the fromSetWirelessRepeat function.
Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromVirtualSer function via the page parameter.
Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromAddressNat function, caused by the entrys parameter.
Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the fromAddressNat function via the page parameter.
Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability via the deviceId parameter in the formSetClientState function.
Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability via the speed_dir parameter in the formSetSpeedWan function.
Version V2.0.1.6 of the Tenda FH1203 contains a stack overflow vulnerability in the formSetDeviceName function via the deviceId parameter.
The Tenda FH1203 V2.0.1.6 device was found to contain a stack overflow vulnerability in the addWifiMacFilter function related to the deviceId parameter.
Version V2.0.1.6 of the Tenda FH1203 has a stack overflow vulnerability via the ssid parameter in the form_fast_setting_wifi_set function.
XWiki Platform has a vulnerability that allows remote code execution via a cross-site request forgery (CSRF) attack using the REST API. Exploitation of this flaw by a user with programming rights can impact the integrity, availability, and confidentiality of the entire XWiki installation.
The MStore API WordPress plugin before 3.9.8 does not sanitize and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features and uses the woocommerce-appointments plugin.