CVE Vulnerability Catalog

A vulnerability in OpenWrt luci-app-samba4 allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.

A vulnerability in Capgo before version 12.128.2 allows enterprise administrators to delete password identities of users in foreign organizations via the SSO prelink endpoint. Attackers with org.update_settings permission and an active SSO provider can permanently remove email-based authentication for any user matching the provider's email domain, forcing victims to use the attacker's SSO provider or complete password reset recovery.

A vulnerability in Capgo before version 12.128.2 allows changing the account email address without requiring current password re-authentication or verification of the existing email address. An attacker with a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

Crawl4AI before version 0.8.8 has a credential exfiltration vulnerability via unauthenticated Docker API endpoints. Attackers can redirect LLM API calls to attacker-controlled servers and read environment variables, including API keys and JWT secrets.

In Capgo before version 12.128.2, a privilege escalation vulnerability exists where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to the stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read sensitive financial and operational metrics via the Supabase PostgREST global_stats endpoint. Using only the public API key, attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

A SQL injection vulnerability was found in the login component of SmartHomeAdatum up to commit cf495353d81b680675eb8d9aa14a318aa45ce12c. An attacker can remotely manipulate the 'Login' argument in users.php, leading to unauthorized database access. The product uses rolling releases, so no specific version numbers are available.

A remote code injection vulnerability was found in SonicCloudOrg sonic-agent up to version 2.7.2 within the JWT Authentication Filter component. The flaw resides in ExchangeController.java and can be exploited remotely. The exploit is publicly disclosed and the product is no longer supported.

A missing authentication vulnerability has been found in an unknown part of TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The flaw can be exploited remotely without authentication.

A security flaw has been discovered in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The vulnerability is an SQL injection in the proses/add.php file, where the kode_produk or kd_cs arguments can be manipulated remotely. The exploit has been publicly released and may be used in attacks.

A SQL injection vulnerability exists in the proses/login.php file of TOKO-ONLINE-ROTI (up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99) via the Username argument. Remote exploitation is possible and a public exploit is available.

A vulnerability was found in shiroiAdmin versions 1.1 and 1.3 in the FileController::upload function within app/common/controller/FileController.php. Manipulating the File argument allows unrestricted file upload, which can be exploited remotely. The exploit has been publicly disclosed.

A buffer overflow vulnerability was found in the TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. The attack can be launched remotely. The vendor states the device is End-of-Life (EOL) and will not be patched.

A buffer overflow vulnerability has been detected in TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. An attacker can remotely exploit this by manipulating the nslookup_target argument. The vendor states the device is End-of-Life (EOL) and will not issue patches.

A SQL injection vulnerability has been found in Aster Telecom Azcall 10/11 in the file /azcall/adm/gestao_loja/sis.php?t=consultar. Manipulating the nome/perfil/status arguments can lead to SQL injection. The attack is remotely exploitable and the exploit has been made public.

A command injection vulnerability was discovered in Trendnet TEW-635BRM up to 1.00.03 in the ipoa_test function of /sbin/rc (IPoA WAN Connection Setup component). Manipulating the ipoa_ipaddr argument allows remote command execution. The vendor does not confirm the flaw and the device has been EOL since 2011.

A vulnerability was found in Trendnet TEW-635BRM up to version 1.00.03 in the start_httpd function of the /sbin/rc file within the Web Service component. Manipulating the device_name argument causes a stack-based buffer overflow, allowing remote exploitation. The vendor does not confirm the issue and states the device has been end-of-life since 2011.

A vulnerability was found in H3C NX15 V100R017 in the administrator password change function. Manipulating the newPass argument in requests to /api/login/modify allows setting a weak password, facilitating password recovery. The attack can be launched remotely and exploit details have been made public.

A deserialization of untrusted data vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

A vulnerability in PraisonAI Platform before version 0.1.9 allows a workspace member to modify owner-created records such as projects, issues, and agents without required owner or admin authorization. For projects, a member can reassign the lead_id to their own user ID and then delete the project, bypassing the delete route's owner/admin permission check.