CVE Vulnerability Catalog

The Wavlink WL-WN530BE1-A router version 251117 contains a stack-based buffer overflow in the strcpy function of /cgi-bin/ExportAllSettings.cgi in the Settings Export CGI component. Manipulating the HTTP_COOKIE/X-Cmd argument allows remote attack.

The Wavlink WL-WN530BE1-A router version 251117 contains a vulnerability in the popen function of /cgi-bin/uploadVpn.cgi. Manipulating the Type argument leads to OS command injection, and the attack can be performed remotely.

Wavlink WL-WN592AX6 version 250422 is vulnerable to a null pointer dereference in the main function of /cgi-bin/upload.cgi, triggered by manipulation of the Cookie argument. The attack can be performed remotely.

Firefox for iOS directly interpolated the page's HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox's privileged content world and bypass the page's Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

The AcyMailing plugin for WordPress in versions up to and including 11.1.0 is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint. The acym_cleanVar() sanitizer only strips complete HTML tags, and SubscriberInsertion::replaceUserInformation() together with the archive view template insert the stored subscriber field value into the mail body without HTML encoding. This allows an unauthenticated attacker to inject arbitrary scripts that execute when the online-archive URL for the poisoned subscriber is accessed.

The Bit Integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress in all versions up to and including 2.10.6 is vulnerable to Stored Cross-Site Scripting via the field mapped to notification_content (attacker-chosen key, e.g. payload_text) due to insufficient input sanitization and output escaping. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow binding the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

Polaris Office App version 9.9.19 on Android has a path traversal vulnerability in the function com.infraware.service.m.n.a of the Document Intake component, triggered by manipulation of the _display_name argument. The attack requires local access.

A security flaw has been discovered in SourceCodester Library Management System 1.0 affecting the move_uploaded_file function in admin/add_admin.php. Manipulation of the image argument results in unrestricted upload. The attack may be initiated remotely and the exploit has been released to the public.

A vulnerability was identified in SourceCodester E-Learning System 1.0 affecting the save_users function in /classes/Users.php?f=save. Manipulation of the img argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in SourceCodester Contact Tracing System 1.0 affecting the move_uploaded_file function in /classes/Users.php?f=save. Manipulation of the img/id argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.

The macOS version of the DigiD app is not signed with Hardened Runtime. This allows a local process to load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the app, gaining access to DigiD data and cryptographic capabilities.

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

The Weaver Xtreme Theme Support plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 7.0.1.

The IMPress for IDX Broker plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 3.3.1.

The FV Simpler SEO plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 1.9.7.

The Responsive Slider plugin for WordPress has a Stored XSS vulnerability. This affects all versions from n/a through 0.1.9.

A vulnerability was found in SourceCodester Human Resource Management System 1.0 in the session_start function of controller/employee.php in the Employee Endpoint component. Manipulation of role/pfimg/EmpId arguments leads to improper authentication. The attack can be launched remotely and the exploit is public.