CVE Vulnerability Catalog

Tenda AC6 V2.0, AC7 V1.0, F1203, AC5, FH1203, AC9, and FH1205 devices were found to contain a stack overflow via the deviceId parameter in the formSetClientState function.

Tenda F1202 V1.2.0.9, PA202 V1.1.2.5, PW201A V1.1.2.5, and FH1202 V1.2.0.9 were found to have a stack overflow vulnerability via the page parameter in the SafeEmailFilter function.

Devices Tenda AC10, AC1206, AC8, AC6, AC7, F1203, AC5, and FH1203 were found to contain a stack overflow via the list parameter in the setaccount function.

Tenda AC7, AC5, AC9, and FH1205 devices were found to contain a stack overflow via the deviceId parameter in the addWifiMacFilter function.

Version 1.01.42 of the Tenda 4G300 was found to contain a stack overflow via the page parameter at /VirtualSer.

A command injection vulnerability was discovered in Netgear R7100LG version 1.0.0.78 via the password parameter at usb_remote_invite.cgi.

CVE-2023-38044 describes an improper neutralization of special elements used in SQL commands, leading to SQL Injection vulnerabilities.

CVE-2023-34477 vulnerability concerns improper neutralization of special elements used in SQL commands, leading to SQL injection.

CVE-2023-34476 vulnerability concerns improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks.

There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.

A vulnerability in LangChain version 0.0.194 allows remote code execution via the from_math_prompt and from_colored_object_prompt functions in the PALChain class. An attacker can inject malicious Python code through the eval mechanism.

A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.

The social-media-skeleton project has a SQL injection vulnerability that allows UNION based injections, which indirectly leads to remote code execution. A fix has been introduced in commit 3cabdd35c3d874608883c9eaf9bf69b2014d25c1.

PHPGurukul Online Security Guards Hiring System version 1.0 is vulnerable to SQL Injection via osghs/admin/search.php.

Knowage is an open source analytics and business intelligence suite. In versions from 6.x.x to prior to 8.1.8, the endpoint `/knowage/restful-services/dossier/importTemplateFile` allows authenticated users to upload template files to the server without requiring authorization, enabling code execution on the server.

An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.

MindsDB's AI Virtual Database prior to version 23.7.4.0 allowed disabling SSL certificate verification using `verify=False`. In version 23.7.4.0, SSL certificate verification is enabled by default, which is the desired behavior.

CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installation function in module management.

Connected IO version 2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication. This allows devices to connect to the broker and issue commands to other devices, impersonating the Connected IO management platform.

Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.