CVE Vulnerability Catalog

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability due to insecure loading of system libraries. The application does not validate the path or signature of regsvr32.exe it loads. An attacker can place a malicious DLL in the startup directory, which will be executed when the user launches the program.

Podatność na obejście uwierzytelniania za pomocą alternatywnej ścieżki lub kanału w systemie ABB Ability Edgenius. Problem ten dotyczy wersji 3.2.0.0 oraz 3.2.1.1.

The read function in thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.

Dataease, an open source data visualization tool, versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in 2.10.14, but JNDI injection remains possible via iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The 'myds' GET parameter is not adequately sanitized before being used in SQL queries.

An issue in Ilevia EVE X1 Server Firmware versions up to v4.7.18.0.eden and Logic Version up to v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the ping.php component, which does not perform secure filtering on IP parameters.

BASIS BBj prior to version 25.00 has a Jetty-served web endpoint that fails to validate or canonicalize path segments, allowing unauthenticated directory traversal to read arbitrary system files. This may expose credentials for BBj Enterprise Manager, enabling administrative access and system command execution.

The SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.

In Looker configured with OIDC authentication, an attacker could take over a user account due to email address string normalization. Looker-hosted and Self-hosted were vulnerable; hosted is mitigated, self-hosted needs upgrade.

The QVidium Opera11 device (firmware 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can inject arbitrary commands via a crafted GET request, executed with root privileges.

Claude Code prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, could be tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploitation requires starting in an untrusted directory and using Yarn 3.0+.

Lookyloo prior to version 1.35.1 has potential cross-site scripting on index and tree pages. This issue has been patched in version 1.35.1.

Rallly prior to version 4.5.4 has an IDOR vulnerability in the poll finalization feature. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter, allowing unauthorized finalization and conversion to events.

The Newtec Celox UHD (models CELOXA504, CELOXA820) running firmware celox-21.6.13 is vulnerable to an authentication bypass. An attacker can modify intercepted responses from the /celoxservice endpoint, injecting a forged response during login to gain Superuser or Operator access without valid credentials.

The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change Admin, Operator, and User passwords, resulting in complete system compromise.

An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser.

Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 expose an unauthenticated backup upload endpoint in the F2MAdmin interface. The script creates a directory and moves an uploaded file with an attacker-controlled filename without authentication or file-type validation. On default Windows deployments, an attacker can upload configuration files leading to arbitrary command execution as NT AUTHORITY\SYSTEM.

AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23 include a web administration component with an unauthenticated script-management endpoint. The saveScript action writes attacker-supplied data directly to a server-side file path under the privileges of the web service account, which runs as NT AUTHORITY\SYSTEM on Windows. An unauthenticated remote attacker can write arbitrary files into the web-accessible directory and execute them.

The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to authentication bypass due to improper JWT validation. Attackers can reuse a valid JWT token from one device to gain administrative access to other devices running the same firmware, even with different passwords and networks.