CVE Vulnerability Catalog

iSherlock opracowany przez HGiga zawiera podatność na wstrzykiwanie poleceń systemowych, która umożliwia nieautoryzowanym zdalnym atakującym wstrzykiwanie dowolnych poleceń systemowych i ich wykonywanie na serwerze.

A broken access control flaw was identified in the /api/v1/setting/data endpoint of Moxa devices. A low-privileged authenticated user can call the API without required permissions to access or modify system configuration data.

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. The Automate 2025.9 patch enforces HTTPS for all agent communications.

OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.

PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Ilevia EVE X1 Server firmware (versions ≤ 4.7.18.0.eden) contains a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware (versions ≤ 4.7.18.0.eden) contains an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privileges to root. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

Ilevia EVE X1 Server firmware (versions ≤ 4.7.18.0.eden) contains an OS command injection vulnerability in mbus_build_from_csv.php that allows an unauthenticated attacker to execute arbitrary code. The vendor declined to fix it and recommends not exposing port 8080 to the internet.

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

WSO2 API Manager has an improper privilege management vulnerability due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this to generate access tokens with elevated privileges, potentially leading to administrative access.

Incomplete cleanup in Qt Network's Schannel support on Windows can lead to a Denial of Service over time. Affects Qt from 5.15.0 through 6.8.3 and from 6.9.0 before 6.9.2.

Deserialization of untrusted data vulnerability in Apache ActiveMQ NMS AMQP Client (all versions up to and including 2.3.0) when establishing connections to untrusted AMQP servers. Malicious servers could exploit unbounded deserialization logic to execute arbitrary code on the client side. The protection mechanism from version 2.1.0 can be bypassed.

SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter in '/index.php?view=ticket_detail'.

SQL injection vulnerability in Sergestec Exito v8.0. It allows an attacker to retrieve, create, update, and delete databases via the 'cat' parameter in '/public.php'.

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.

In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver. It could cause a remote execution after receiving a crafted sequence of packets.

Wtyczka Felan Framework dla WordPressa jest podatna na niewłaściwą autoryzację w wersjach do 1.1.4 włącznie. Problem wynika z hardcodowanego hasła w funkcjach 'fb_ajax_login_or_register' oraz 'google_ajax_login_or_register', co umożliwia nieautoryzowanym atakującym logowanie się jako dowolny istniejący użytkownik, jeśli zarejestrował się za pomocą logowania społecznościowego Facebook lub Google i nie zmienił hasła.

Wtyczka Truelysell Core dla WordPressa jest podatna na nieautoryzowaną zmianę haseł użytkowników w wersjach do 1.8.6 włącznie. Problem wynika z udostępnienia przez wtyczkę dostępu do obiektów kontrolowanego przez użytkownika, co pozwala na ominięcie autoryzacji i dostęp do zasobów systemowych.

Azure Access Technology BLU-IC2 and BLU-IC4 devices are affected by an allocation of resources without limits or throttling vulnerability that allows flooding attacks. The issue affects versions through 1.19.5.

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom. The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. This vulnerability is due to an incomplete fix for CVE-2025-61927. The vulnerability is fixed in 20.0.2.