CVE Vulnerability Catalog

An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W (firmware 1.2.2.5/1.2.2.8) routers. The model_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.

An OS command injection vulnerability exists in the start_bonjour() function of the 'rc' binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5/1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.

Snowflake Terraform Provider versions prior to 2.18.0 contain SQL injection and DDL injection vulnerabilities. An attacker can exploit unsanitized data source inputs to execute arbitrary SQL queries with the provider's privileged session, enabling data exfiltration and creation of long-lived access credentials. Improper identifier sanitization in user resources allows DDL injection, potentially creating accounts with attacker-controlled credentials.

An XSS vulnerability was found in the Ad Hoc module of Progress MOVEit Transfer due to improper input neutralization during page generation. This allows an attacker to inject malicious JavaScript into a victim's browser.

This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo application.

In Adalo's no-code app builder (Versions 1 and 2), attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

A missing release of memory after effective lifetime vulnerability has been found in the Custom Reports module of Progress MOVEit Transfer. It affects versions 2025.0.0 before 2025.0.8, 2025.1.0 before 2025.1.4, and 2026.0.0 before 2026.0.1.

A vulnerability in Progress MOVEit Transfer's Custom Reports module involves improper neutralization of special elements in data query logic. This allows an attacker to manipulate queries, potentially leading to unauthorized data access.

A SQL injection vulnerability in n8n before versions 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 exists in the legacy MySQL v1 node's executeQuery operation. Evaluated {{ ... }} expression values are substituted directly into the raw SQL string without parameterization, allowing an attacker to inject arbitrary SQL through input reaching these expressions when the workflow is connected to an externally reachable trigger (e.g., Webhook).

The Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 allows authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. It uses the workflow:read scope instead of workflow:execute, enabling an authenticated user with read-only access to trigger a real test run of the workflow.

FreeRDP before version 3.22.0 has a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.

A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to access sensitive organizational data of users via the RPC function public.get_orgs_v6. This function, defined as SECURITY DEFINER and granted to the anon role, does not verify that the user UUID matches the authenticated context.

Dell PowerProtect Data Domain in multiple versions contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell PowerProtect Data Domain in multiple versions contains an integer overflow or wraparound vulnerability. An unauthenticated remote attacker could exploit this flaw, leading to a denial of service (DoS).

In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

Dell PowerProtect Data Domain in multiple versions contains a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could exploit this flaw.

Omnissa Workspace ONE Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. An attacker with local access could exploit this flaw to gain elevated privileges.