CVE Vulnerability Catalog

A vulnerability in Eleveo Call Recording Software up to 10.3.0 affects unknown code in the /auth/realms/default/protocol/openid-connect/logout file of the JWT Token Handler component. Manipulating the id_token_hint argument can lead to the use of the GET request method with sensitive query strings. The attack can be launched remotely but is difficult to exploit.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/adminregister.php of the Registration Handler component, allowing remote SQL injection.

A use-after-free (UAF) vulnerability was found in the Linux kernel's scheduler cache grouping mechanism. Scheduler statistics were stored in the mm structure, allowing access after the old mm was freed during context switching. The issue was fixed by extracting these statistics into a separate refcounted object.

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

A SQL injection vulnerability in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock remediated the issue on 2026-08-12; no customer action is required.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/authprocessing.php of the Forgot Password Handler component, where manipulation of the fpemail argument leads to SQL injection.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/loginprocessing.php of the Login Handler component, where manipulation of email/password arguments leads to SQL injection.

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR routers in versions 1.03B01/1.03B03, affecting the fwrite function in pigwidgeon.cgi of the Web Management Backend component. Manipulation of the service argument leads to OS command injection, and the attack can be launched remotely. The exploit is publicly available.

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. It impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. The attack can be initiated remotely. The vendor was contacted but did not respond.

A vulnerability in y_project RuoYi up to 4.8.3 affects the renderDrawer function in the /system/dict/data/add file of the Dictionary Data Drawer Preview component. Manipulating the cssClass argument can lead to cross-site scripting. The attack can be performed remotely, and the exploit has been publicly disclosed.

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission, but does not apply the search limit on that permission. A low-privileged attacker can read interfaces of hosts they are not allowed to view, and if they have edit permissions, they can modify those interfaces.

A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged attacker who is allowed to delete filters for one role only can delete filters belonging to other unlocked roles, leading to loss of access to resources.

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.

Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.

Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.