CVE Vulnerability Catalog

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.

A vulnerability was found in Netcore NAP930 0.1.241010.141410 in the eval function of the /www/cgi-bin/network_tools file of the Network Tools CGI component. Manipulation of the sid argument results in OS command injection. The attack can be performed remotely and the exploit has been made public.

A security flaw was discovered in FAST FAC1203R 20200116_2.0.4 in the _tWlanTask function of the MmtAtePrase Parser component. Manipulation results in a stack-based buffer overflow. The attacker must have access to the local network, and the exploit has been released.

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0 in an unknown function of the /api/ZRnetwork/set_passwd file. Manipulation of the password1 argument causes command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0 in some unknown processing of the /api/ZRQos/set_online_client file. Manipulation of the mac argument results in command injection. The attack can be launched remotely and the exploit has been made public.

A vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 affects unknown code in the file /api/ZRQos/set_online_client. Manipulation of the argument ip leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

A flaw in Ziroom ZHOME A0101 version 1.0.1.0 affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Manipulation of the argument login_pwd leads to command injection. The attack can be performed remotely, and the exploit is published.

A vulnerability was detected in Ziroom ZHOME A0101 version 1.0.1.0, affecting unknown functionality of the file /api/ZRnetwork/firstLogin. Manipulation of the argument firstLogin results in command injection. The attack can be performed remotely, and the exploit is public.

PyJWT is a Python implementation of JSON Web Token standards. Prior to version 2.14.0, is_pem_format in jwt/utils.py does not recognize every PEM representation accepted by the cryptography loader. When an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. An attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

A weakness in Ziroom ZHOME A0101 version 1.0.1.0 affects the function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua of the USB Device Management API component. Manipulation of the argument path causes command injection. The attack can be performed remotely, and the exploit is publicly available.

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6. The books() function in site/booklibrary.php reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(), whose only real protection is a keyword blacklist that, on detecting the literal substring select, wraps the value in $db->quote() instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two conditions: a first request to prime session-stored sort defaults, and a trailing decoy comment (-- xselect) that satisfies the blacklist’s substring check without altering the payload’s effect.

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8. The site/vehiclemanager.php file reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect.

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9. The site/realestatemanager.php file builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

The decompress package for Node.js before versions 10.2.2 and 11.1.4 (and the unmaintained decompress package up to 4.2.1) has a vulnerability allowing bypass of path checks via symlink chains. A crafted archive can allow reading/writing files outside the output directory, and overwriting startup scripts or configuration can lead to remote code execution.

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.