CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
W MyBiz MyProcureNet w wersji 5.0.0 odkryto problem, który pozwala atakującemu na przesłanie złośliwego pliku na serwer WWW. Atakujący może przesłać skrypt, który umożliwia wydawanie poleceń systemu operacyjnego.
Vulnerability in Spring Data Commons (versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions) due to improper neutralization of special elements in the property binder. An unauthenticated remote attacker can supply specially crafted request parameters against Spring Data REST backed HTTP resources or use Spring Data's projection-based request payload binding, leading to remote code execution.
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
A vulnerability in Trustwave Secure Web Gateway (SWG) through version 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, leading to remote root access.
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.
The XXE vulnerability in the XML processing functionality in Play before version 2.2.6 and 2.3.x before 2.3.5 may allow remote attackers to read arbitrary files, cause denial of service, or have unspecified other impacts via crafted XML data.
The admin terminal in Hawt.io does not require authentication, allowing remote attackers to execute arbitrary commands via the k parameter.
A vulnerability in BAS920 and ISC2000 devices allows remote attackers to obtain sensitive information through a specific request. Attackers can gain credential information for the Supervisor/Administrator account.
A buffer overflow vulnerability in NetTransport Download Manager version 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
PHP Scripts Mall PHP Multivendor Ecommerce has an SQL Injection vulnerability via the usid parameter in the seller-view.php file.
PHP Scripts Mall PHP Multivendor Ecommerce has an SQL Injection vulnerability via the fid parameter in my_wishlist.php.
PHP Scripts Mall PHP Multivendor Ecommerce is vulnerable to SQL Injection via the cusid parameter in shopping-cart.php.
Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. The deserialization process can execute code that has undesired side effects for several known types.
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine.
The AirLive BU-2015, BU-3026, MD-3025, WL-2000CAM, and POE-200CAM v2 devices have a vulnerability related to the use of hard-coded credentials in the embedded Boa web server. Attackers can gain access to user data through specially crafted HTTP requests.
The Easy2Map plugin before version 1.3.0 for WordPress contains multiple directory traversal vulnerabilities in the includes/MapImportCSV2.php and includes/MapImportCSV.php files, allowing remote attackers to include and execute arbitrary files via the csvfile parameter related to upload file functionality.
The RPC service in Tripwire IP360 VnE Manager versions 7.2.2 and earlier allows remote attackers to bypass authentication and enumerate users, reset passwords, or manipulate IP filter restrictions via crafted 'privileged commands'.
A vulnerability has been identified in Siemens 7KT PAC1200 data manager (7KT1260) in all versions < V2.03. The integrated web server (port 80/tcp) of the affected devices could allow an unauthenticated remote attacker to perform administrative operations over the network.