CVE Vulnerability Catalog

AndSoft e-TMS v25.03 is vulnerable to SQL injection in /inc/connect/CONNECTION.ASP via the 'SessionID' cookie. An attacker can send a POST request to retrieve, create, update, and delete database data.

SQL injection vulnerability in AndSoft's e-TMS v25.03. It exists in the 'USRMAIL' parameter in '/inc/login/TRACK_REQUESTFRMSQL.ASP' and allows an attacker to retrieve, create, update, and delete databases by sending a POST request.

An operating system command injection vulnerability exists in AndSoft's e-TMS v25.03.03. An attacker can execute arbitrary OS commands on the server by sending a crafted POST request with the 'm' parameter to '/CLT/LOGINERRORFRM.ASP'.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_CAT.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_original.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_BET.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_LXA.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_DJO.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

OpenSIAC has an incorrect authentication vulnerability that could allow an attacker to impersonate a person using Cl@ve as an authentication method.

Wtyczka Ajax WooSearch dla WordPressa w wersji do 1.0.0 nieprawidłowo sanitizuje i nie ucieka parametru przed użyciem go w zapytaniu SQL za pośrednictwem akcji AJAX dostępnej dla nieautoryzowanych użytkowników, co prowadzi do podatności na atak SQL injection.

RISC Zero versions 2.0.2 and below of risc0-zkvm-platform allow the host to use a crafted response to the guest's sys_read call to write to an arbitrary memory location in the guest. This can lead to arbitrary code execution within the guest and critically compromises the soundness guarantees of the guest program. Fixes are in risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3.

Termix versions 1.5.0 and below, when using the official Docker image or an Nginx reverse proxy, incorrectly identifies the client IP as the proxy IP, causing isLocalhost to always return True. This makes the /ssh/db/host/internal endpoint accessible without login or authentication, exposing stored SSH host information including addresses, usernames, and passwords.

In ExtremeGuest Essentials before 25.5.0, the captive-portal may permit unauthorized access via a manual brute-force procedure. Under certain captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access, and Client360 logs may show the client MAC as the username despite MAC-authentication being disabled.

In the Linux kernel TIPC module, during link MTU negotiation, a malicious peer can send an Activate message with a very small MTU (e.g., 4). Without checking the minimum MTU, this value is set as the link MTU, leading to an integer overflow when calculating message size and potentially causing a system crash.

Vulnerability in pyfory library (versions 0.12.0-0.12.2 and legacy 0.1.0-0.10.3) allows deserialization of untrusted data, leading to arbitrary code execution. An attacker can craft a data stream that forces the pickle-fallback serializer, resulting in pickle.loads and remote code execution.

Wtyczka Custom Searchable Data Entry System dla WordPressa jest podatna na nieautoryzowane usuwanie danych z bazy w wersjach do 1.7.1 włącznie, z powodu braku sprawdzenia uprawnień oraz niewystarczającej walidacji w funkcji ghazale_sds_delete_entries_table_row(). Umożliwia to nieautoryzowanym atakującym całkowite usunięcie tabel w bazie danych, takich jak wp_users.

Aplikacja internetowa Telenium Online jest podatna na ataki z powodu punktu końcowego PHP, który jest dostępny dla nieautoryzowanych użytkowników sieci i niewłaściwie obsługuje dane wejściowe dostarczane przez użytkowników. Podatność ta wynika z niebezpiecznego zakończenia sprawdzenia wyrażenia regularnego w tym punkcie końcowym.

NiceHash QuickMiner version 6.12.0 performs software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update URL can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution.

W Red Hat Openshift AI Service odkryto lukę, która pozwala atakującemu z niskimi uprawnieniami, posiadającemu dostęp do uwierzytelnionego konta, na eskalację uprawnień do pełnego administratora klastra. To umożliwia całkowite naruszenie poufności, integralności i dostępności klastra.