CVE Vulnerability Catalog

Vulnerability in SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to inject arbitrary ABAP code or OS commands via the RFC-exposed function module, bypassing authorization checks.

SAP Landscape Transformation zawiera podatność, która pozwala atakującemu z uprawnieniami administratora na wykorzystanie luki w module funkcji udostępnionym przez RFC. Luka ta umożliwia wstrzykiwanie dowolnego kodu ABAP/komend systemowych do systemu, omijając istotne kontrole autoryzacji.

Stack-based buffer overflow in the ethos utility of RIOT OS up to version 2026.01-devel-317. Missing bounds checking in _handle_char() allows writing past the stack buffer when processing serial frames.

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input.

Vulnerability in Appsmith before 1.93: the server uses the Origin header value as the email link baseUrl without validation. An attacker controlling Origin can cause password reset / email verification links to point to their domain, exposing authentication tokens and potentially leading to account takeover.

Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.

A buffer overflow vulnerability exists in the ippprint (Internet Printing Protocol) service of the Sagemcom F@st 3686 router, version MAGYAR_4.121.0. A remote attacker can execute arbitrary code by sending a crafted HTTP request.

Vulnerability in ServiceNow AI Platform allows an unauthenticated user to impersonate another user and perform operations that the impersonated user is entitled to perform.

W systemie zarządzania siłownią amansuryawanshi Gym-Management-System-PHP 1.0 występuje wiele podatności na ataki SQL Injection poprzez parametry 'name', 'email' i 'comment' w pliku submit_contact.php, 'username' i 'pass_key' w secure_login.php oraz 'login_id', 'pwfield' i 'login_key' w change_s_pwd.php. Atakujący, zarówno nieautoryzowany, jak i autoryzowany, może wykorzystać te luki do ominięcia uwierzytelnienia, wykonania dowolnych poleceń SQL, modyfikacji rekordów w bazie danych, usunięcia danych lub eskalacji uprawnień do poziomu administratora.

Remote Code Execution (RCE) vulnerability in Sourcecodester Covid-19 Contact Tracing System 1.0. The application accepts a reverse shell (php) into the user's image, enabling RCE.

SQL Injection vulnerability in /exam/user/profile.php of kashipara Online Exam System V1.0. Remote attackers can execute arbitrary SQL commands to gain unauthorized database access via the rname, rcollage, rnumber, rgender, and rpassword parameters in a POST request.

CVE-2026-22785 dotyczy podatności w orval, który generuje typowo bezpieczne klienty JS (TypeScript) z specyfikacji OpenAPI v3 lub Swagger v2. W wersjach przed 7.18.0 logika generacji serwera MCP opiera się na manipulacji ciągami, co pozwala na wstrzykiwanie dowolnego kodu poprzez niewłaściwą walidację pola podsumowania.

Vulnerability in DFIR-IRIS (Iris platform) before version 2.4.24: mass assignment of the file_local_name field combined with path trust in the delete operation enables authenticated users to delete arbitrary filesystem paths.

TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess(). An unauthenticated remote attacker can execute arbitrary commands on the server by injecting Windows shell metacharacters into HTTP requests. This vulnerability is fixed in 1.98.

LibreChat prior to v0.8.2-rc2 has a vulnerability in the MCP stdio transport that accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.

In DDSN Interactive Acora CMS v10.7.1, the password reset function uses a static token, allowing an attacker to reuse the same token to reset any user's password and perform a full account takeover.

An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component.

An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges.

The D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The lack of rolling codes, message authentication, or anti-replay protection allows an attacker within RF range to record valid alarm/control frames and replay them to trigger false alarms.

Imaster's MEMS Events CRM contains an SQL injection vulnerability in the 'phone' parameter in '/memsdemo/login.php'.