CVE Vulnerability Catalog

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an unauthenticated SQL injection vulnerability was found. The showSearchResult() and showSearchResultAjax() functions read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and only strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login, and the search module is public.

An unauthenticated Remote Code Execution vulnerability was found in REDCap 13.3.0 and higher in the survey passthrough routing and Data Import processing logic. An attacker can manipulate HTTP requests to access an unintended controller route from a public survey context and supply a crafted file-path/stream parameter during import handling. Exploitation requires knowledge of a valid public survey hash.

A stack-based buffer overflow vulnerability was found in Comfast CF-N1-S 2.6.0.1 in the get_css_path_from_uri function of /cgi-bin/mbox-config in the Web Management Interface. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.

Use-after-free vulnerability in Suricata before 8.0.7 occurs in the Http2ThreadMultiBuf mechanism when a transaction is inspected by rules using http.response_header with and without a transform.

In Suricata before 8.0.7, a type confusion in DoH2 can cause an invalid free because cleanup code for HTTP2 state runs even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is default in 8.x versions.

Vulnerability in D-Link R95 (BE9500_1.00.16) affects the system function in /bin/ssi of the DHMAPI component. Manipulation of the NTPServer argument results in OS command injection. The attack can be executed remotely, and the exploit is public.

OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. These attributes are passed to require without checking that the value names a module, allowing loading and executing code from any file.

A vulnerability has been identified in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWsc function of the /boafrm/formWsc file. Manipulation of the localPin argument leads to command injection. The attack can be launched remotely, and a public exploit is already available.

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

A vulnerability has been discovered in the Totolink A3002MU router (version Hh-B20211125.1046) in the formWlWds function of the /boafrm/formWlWds file. Manipulation of the submit-url argument results in a buffer overflow. The attack can be launched remotely, and a public exploit has already been released.

The Forminator Forms plugin for WordPress (versions up to and including 1.57.2) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

The WP Recipe Maker plugin for WordPress (versions up to and including 10.8.1) is vulnerable to arbitrary shortcode execution. The sanitize_metadata() function recursively calls do_shortcode() on recipe metadata fields, including reviewBody populated from comment content, without sanitizing shortcode tokens before execution. Unauthenticated attackers can execute arbitrary registered shortcodes on every recipe page render, disclosing data in JSON-LD metadata.

The Gravity Forms plugin for WordPress (versions up to and including 3.1.0.4) is vulnerable to arbitrary file upload via the upload_file function. A mismatch between validation and persistence pipelines allows hidden file upload fields to bypass extension validation. Unauthenticated attackers can upload executable files, enabling remote code execution.

A buffer overflow vulnerability was identified in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlEncrypt function of the /boafrm/formWlEncrypt file. Manipulation of the submit-url argument allows remote exploitation. The exploit is publicly available and may be used.

A buffer overflow vulnerability was determined in the Totolink A3002MU (version Hh-B20211125.1046) within the formWlAc function of the /boafrm/formWlAc file. Manipulation of the submit-url argument can lead to a buffer overflow. The attack may be performed remotely, and the exploit has been publicly disclosed.

A flaw was found in the OpenShift console allowing unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints. A remote attacker can send crafted devfile payloads, leading to Server-Side Request Forgery (SSRF) and, by sending repeated large requests without a specified content length, to unbounded memory growth and Denial of Service (DoS).

A buffer overflow vulnerability was found in the Totolink A3002MU (version Hh-B20211125.1046) within the formSchedule function of the /boafrm/formSchedule file. Manipulation of the webpage argument results in a buffer overflow. The attack is possible remotely, and the exploit has been made public.