CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w pliku rsvpmaker-api-endpoints.php. Umożliwia to nieautoryzowanym atakującym kradzież wrażliwych informacji z bazy danych w wersjach do 9.2.6 włącznie.
Wtyczka RSVPMaker dla WordPressa jest podatna na nieautoryzowaną injekcję SQL z powodu braku odpowiedniego zabezpieczenia i parametryzacji danych dostarczanych przez użytkowników w zapytaniach SQL w pliku rsvpmaker-util.php. Atakujący mogą uzyskać dostęp do wrażliwych informacji z bazy danych w wersjach do 9.2.5 włącznie.
An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file.
In Sourcecodester Doctor's Appointment System 1.0, a vulnerability allows remote code execution (RCE) via malicious file upload as an image from the admin panel. An attacker can gain full server control just by knowing the path where images are stored.
A Remote Code Execution (RCE) vulnerability exists in Ruijie RG-EW Series Routers running ReyeeOS up to version 1.55.1915 / EW_3.0(1)B11P55. The flaw is located in the checkNet function within /cgi-bin/luci/api/auth.
A vulnerability in SiteServer CMS version 7.x allows attackers to execute arbitrary code via a crafted plug-in. The flaw stems from insufficient security checks on plug-ins loaded into the system.
A vulnerability in Wondershare Dr. Fone (version as of 2021-12-06) allows remote code execution. An unauthenticated user can communicate over UDP with the InstallAssistService.exe service (running with SYSTEM privileges) and manipulate it to execute a malicious executable without any validation, gaining SYSTEM privileges.
The vulnerability in the httpx library before version 0.23.0 is caused by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`. This can lead to unexpected behavior or potential attacks.
CuppaCMS v1.0 contains a SQL injection vulnerability in the file /administrator/alerts/alertLightbox.php. An attacker can exploit this flaw to execute unauthorized database queries.
CuppaCMS v1.0 contains a SQL injection vulnerability in the menu_filter parameter at /administrator/templates/default/html/windows/right.php. An attacker can exploit this flaw to manipulate database queries.
SCBS Online Sports Venue Reservation System v1.0 was found to have a local file inclusion (LFI) vulnerability. This allows an attacker to execute arbitrary code via a crafted PHP file.
An issue was discovered in MISP before version 2.4.158 related to PHAR deserialization.
Wtyczka SiteGround Security dla WordPressa jest podatna na obejście uwierzytelniania, co pozwala nieautoryzowanym użytkownikom zalogować się jako użytkownicy administracyjni. Problem wynika z braku weryfikacji tożsamości podczas początkowej konfiguracji 2FA, co umożliwia nieautoryzowanym użytkownikom skonfigurowanie 2FA dla oczekujących kont.
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. The vendor states that files can only be uploaded and published by trusted users, which is intentional.
An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file.
An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.
Online Banking System Protect v1.0 contains a local file inclusion (LFI) vulnerability via the pages parameter. This allows an attacker to read sensitive files on the server.
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
In Totolink A3100R V5.9c.4577, multiple pages can be read without authentication using curl or Burp Suite. Additionally, admin configurations can be set without requiring cookies.