CVE Vulnerability Catalog

Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin. This vulnerability only affects products that are no longer supported by the maintainer.

Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. This vulnerability only affects products that are no longer supported by the maintainer.

Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via function phpcgi_main in cgibin.

Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.

The vulnerability allows remote code execution in Ruijie Networks products, such as RG-EW home routers, RG-NBS and RG-S1930 switches, RG-EG VPN routers, and EAP and RAP access points. Attackers can gain the highest privileges via a crafted POST request to /cgi-bin/luci/api/auth.

Wifi Soft Unibox versions 3.0 and 3.1 are vulnerable to SQL Injection. The vulnerability occurs due to the lack of validation or sanitization of user input in the username field on the login page.

SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the 'id' parameter in /Ant_Suxin.php. An attacker can manipulate this parameter to execute unauthorized database queries.

CVE-2023-35861 describes a shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before version 03.10.35) that allows remote attackers to inject and execute arbitrary commands as root on the BMC.

In the GitHub repository thorsten/phpmyfaq prior to version 3.1.16, there is improper neutralization of formula elements in a CSV file.

Insufficient session expiration exists in GitHub repository fossbilling/fossbilling prior to version 0.5.5.

CVE-2023-37214 affects the Heights Telecom ERO1xS-Pro device with firmware version FW BZ_ERO1XP.025. This issue may lead to unauthorized access or other security-related threats.

Version 2.2.0 and below of university compass was found to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability can be exploited by passing an unchecked argument.

Versions oscore v2.2.6 and below were found to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability can be exploited by passing an unchecked argument.

Versions wix-embedded-mysql v4.6.1 and below were found to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability can be exploited by passing an unchecked argument.

Versions of stanford-parser v3.9.2 and below were found to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability can be exploited by passing an unchecked argument.

FFmpeg version 0.7.0 and below contains a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>. This vulnerability is exploited by passing an unchecked argument.

Versions quartz-jobs 2.3.2 and below contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited by passing an unchecked argument.

Versions bboss-persistent v6.0.9 and below were found to contain a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool. This vulnerability is exploited by passing an unchecked argument.

Versions of webmagic-extension v0.9.0 and below were discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.

Duke v1.2 and below was found to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.