CVE Vulnerability Catalog

An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to database with sensitive data. This issue affects Asseco mMedica in versions before 11.9.5.

In the IPv4 stack of the Linux kernel, functions icmpv4_xrlim_allow() and ip_defrag() were changed to prevent a potential use-after-free vulnerability. Also, dst_dev_rcu() with lockdep support was added to several other functions.

Podatność SQL injection w tlocke pg8000 w wersji 1.31.4 umożliwia zdalnym atakującym wykonywanie dowolnych poleceń SQL poprzez specjalnie przygotowany input w postaci listy Pythona do funkcji pg8000.native.literal.

Apache Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system that supported ANSI escape sequences, an attacker could use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker-controlled command.

BLU-IC2 and BLU-IC4 devices enforce a weak password policy. The issue affects versions through 1.19.5.

The Rox software running BeWelcome contains a PHP object injection vulnerability due to deserialization of untrusted data. The `formkit_memory_recovery` parameter and the `bwRemember` cookie are passed to unserialize(), allowing an attacker to execute arbitrary code or write files on the server.

W MikroTik RouterOS w wersji 7.14.2 oraz SwOS w wersji 2.18 występuje problem, który domyślnie udostępnia interfejs zarządzania WebFig przez niezabezpieczony protokół HTTP. Umożliwia to atakującemu przechwycenie danych logowania poprzez wykonanie wstrzykniętego kodu JavaScript w przeglądarce administratora.

W systemie eTimeTrackLite Web do wersji 12.0 (20250704) odkryto lukę w kontroli uprawnień, która pozwala nieautoryzowanym atakującym na dostęp do określonych tras oraz modyfikację konfiguracji połączeń z bazą danych.

SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the database by sending a POST request using the ‘buscame’ parameter in ‘/catalogo_c/catalogo.php’.

W podatności CVE-2025-62959 występuje niewłaściwa kontrola generowania kodu, co prowadzi do możliwości zdalnego wstrzyknięcia kodu w aplikacji videowhisper Paid Videochat Turnkey Site w wersjach od n/a do 7.3.23. Problem ten może umożliwić atakującym wykonanie nieautoryzowanego kodu na serwerze.

BLU-IC2 and BLU-IC4 devices do not enforce an initial password change at first login. The issue affects versions through 1.19.5.

A vulnerability in BLU-IC2 and BLU-IC4 devices (through version 1.19.5) allows mail configuration file manipulation and command execution. This can lead to full device compromise.

BLU-IC2 and BLU-IC4 devices include a vulnerable version of BusyBox 1.31.1 with multiple known security vulnerabilities. The issue affects versions through 1.19.5.

Vulnerable components are present in the Azure Access OS of BLU-IC2 and BLU-IC4 devices. The issue affects versions through 1.19.5.

The devices use weak default credentials that can be easily guessed or cracked. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

BLU-IC2 and BLU-IC4 devices through version 1.19.5 use the default SNMP community string 'public'. This allows unauthorized access to management information via SNMP.

Emlog Pro version 2.5.23 is vulnerable to a session verification code error due to a clearing logic error. The verification code could be reused anywhere an email verification code is required. The issue is fixed in commit 1f726df.

Antabot White-Jotter w wersji do commita 9bcadc zawiera podatność na zdalne wykonanie kodu (RCE) bez uwierzytelnienia, która występuje w komponencie /api/aaa;/../register.

Undocumented administrative accounts are being created to facilitate access for applications running on the device. This issue affects BLU-IC2 and BLU-IC4 through version 1.19.5.

A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of user input in the language functionality allows SQL Injection attacks. This affects older branches of the software.