CVE Vulnerability Catalog

Urządzenia TP-Link TL-WR845N z oprogramowaniem układowym TL-WR845N(UN)_V4_200909 i TL-WR845N(UN)_V4_190219 zawierają twardo zakodowane hasło dla konta root, które można uzyskać poprzez analizę pobranego oprogramowania lub atak brute force przy fizycznym dostępie do routera. Problem został rozwiązany w wersjach oprogramowania 250401 lub nowszych.

An arbitrary file upload vulnerability was found in FoxCMS v1.2.5 within the LocalTemplate.php component. Attackers can upload a crafted ZIP file, leading to arbitrary code execution on the server.

FoxCMS version 1.2.5 was found to contain a remote code execution (RCE) vulnerability in the index() method at \controller\Sitemap.php. An attacker can exploit this flaw to execute arbitrary code on the server.

JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability in the component \c\PluginsController.php. This allows attackers to perform intranet scanning via a crafted request.

An arbitrary file upload vulnerability in Jizhicms v2.5.4 component TemplateController.php allows attackers to execute arbitrary code by uploading a crafted ZIP file.

An arbitrary file upload vulnerability was found in Emlog Pro version 2.5.3 within the admin\plugin.php component. It allows an attacker to execute arbitrary code by uploading a crafted ZIP file.

In the Linux kernel, a vulnerability in the netfilter conntrack module has been fixed, where after insertion of a conntrack entry, a clash can occur, leading to freeing skb->_nfct and setting it to an already-confirmed entry. This was not found before because the conntrack entry and extension space were freed after an RCU grace period, and the race requires events enabled to trigger.

In the Linux kernel, the NFSv4 subsystem has a bug causing free of an uninitialized nfs4_label during referral lookup. The fix sends the already-allocated fattr along with nfs4_fs_locations and drops the memcpy of fattr, fixing a crash during 'ls' operations.

In the Linux kernel, a vulnerability in the DLM module causes an invalid memory read during file unlock (plock) operations. The bug occurs when a 'plock_op' structure is cast to 'plock_xop' and fields not present in the original structure are accessed, leading to a slab-out-of-bounds read. The fix moves the 'callback' field to 'struct plock_op' to indicate when such casting is allowed.

In the Linux kernel, in the nfsd_file_put() function in NFSD, a potential use-after-free was fixed. Since nfsd_file_put_noref() can free @nf, it should not be dereferenced after return.

In the Linux kernel, in the svc_rdma_build_writes() function in SUNRPC, an overflow issue with RDMA segments was fixed by preventing walking off the end of the segment array.

In the Linux kernel, in the nfssvc_decode_writeargs() function in NFSD, an underflow issue with 'args->len' was fixed by changing the type to unsigned.

In the Linux kernel, in the hisilicon/sec crypto driver, a bug with the aead software fallback was fixed. Misuse of the subreq pointer caused occasional OS panics when setting the 64K page.

In the Linux kernel, the bcmgenet driver has an issue with ordering of device register reads/writes. GCC12 optimizes memory operations in a way that breaks the assumed ordering, leading to transmit queue timeouts and NETDEV WATCHDOG warnings. The fix replaces relaxed variants with safer readl/writel functions.

In the Linux kernel's rxrpc module, a race between call timer start and call destruction can lead to a timer being restarted after it was stopped, causing an oops. The fix takes a reference on the rxrpc_call struct before starting the timer.

In the Linux kernel, in the net/tls module, a slab-out-of-bounds bug in decrypt_internal was fixed. The issue was due to incorrect IV size for AES128-CCM, causing an out-of-bounds read.

In the Linux kernel, a vulnerability in the cifs driver was fixed that could lead to a buffer overflow when handling symbolic links. The issue was due to a missing check that link_len does not exceed the size of the link_str buffer. A check was added.

W podatności CVE-2025-26974 występuje niewłaściwe neutralizowanie specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości przeprowadzenia ataku typu Blind SQL Injection w wtyczce WP Multistore Locator. Problem dotyczy wersji od n/a do 2.5.1.

Podatność CVE-2025-26966 dotyczy systemu PrivateContent, umożliwiając obejście uwierzytelnienia za pomocą alternatywnej ścieżki lub kanału. Problem ten występuje w wersjach od n/a do 8.11.5 włącznie.

Podatność CVE-2025-26943 dotyczy niewłaściwej neutralizacji specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości przeprowadzenia ataku typu Blind SQL Injection w aplikacji Easy Quotes w wersjach od n/a do 1.2.2.