CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability was found in the TRENDnet TEW-432BRP firmware version 3.10B20, specifically in the formSetRoute function of the /goform/formSetRoute file. An attacker can remotely manipulate the ip/mask/gateway arguments to trigger the overflow. The exploit has been publicly disclosed and may be used.

The form-data-objectizer library before version 1.0.1 is vulnerable to prototype pollution via processing bracket-notation form keys (e.g. name[sub]). An attacker can send a form field with a name starting with __proto__, causing mutation of Object.prototype and affecting the entire Node.js process.

In n8n-MCP prior to 2.51.2, when ENABLE_MULTI_TENANT=true, HTTP requests without x-n8n-url or x-n8n-key headers silently fell back to the operator's credentials, allowing an authenticated MCP tenant to execute n8n management calls against the operator's instance instead of its own.

In asn1c version 1.4 and earlier, a memory safety vulnerability was found in the generated OER decoding code for INTEGER type. When parsing a maliciously crafted zero-length OER payload for a variable-length non-negative INTEGER, the decoder fails to validate required bytes before extracting the Most Significant Bit, causing a precise 1-byte Heap Out-of-Bounds Read.

In AVideo 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.

Roslyn CodeLens MCP Server versions 0.0.9 through 1.17.0 contain a vulnerability where the get_diagnostics MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the solution without any allowlist, signature check, or user confirmation. An attacker can place a malicious .csproj referencing an attacker-controlled DLL in a location the victim opens with the MCP server, leading to arbitrary code execution with the server's OS privileges.

Home Assistant Companion apps for iOS and Android expose a JavaScript bridge to the in-app WebView that is vulnerable to cross-origin iframe attacks. This flaw allows arbitrary JavaScript execution in the main-frame origin of the Home Assistant frontend and exfiltration of the signed-in user's access token.

In FreePBX prior to versions 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs.

The CDR Reports module in FreePBX before versions 16.0.50 and 17.0.11 contains an SQL injection vulnerability via the 'order' and 'sort' POST parameters. Authentication with a CDR section access account is required, but full admin privileges are not needed.

In FreePBX prior to 17.0.8, the OAuth2 implementation in the API module does not properly validate client credentials during token issuance. The validateClient() method in ClientRepository.php always returns true, allowing anyone with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret.

A vulnerability in DreamMaker by Interinfo allows unauthenticated local attackers to read arbitrary system files via Relative Path Traversal.

DreamMaker by Interinfo has an Arbitrary File Upload vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, leading to arbitrary code execution on the server.

An unhandled exception in Suprema BioStar 2 (Server) versions 2.9.8, 2.9.10, and 2.9.11 allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending HTTP POST requests to the '/api/migration' endpoint. This triggers a failure that halts critical processes, leaving the system offline until manual restart of services or the server.

HAX CMS versions up to 26.0.0 contain a stored XSS vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with page editing permissions can bypass the HTML sanitizer by injecting an event handler attribute without whitespace before the attribute name.

A stored XSS vulnerability exists in the Projects component of Mautic 7. User-supplied project names are rendered without proper sanitization in administrative views, allowing injection of malicious scripts.

An authorization bypass vulnerability exists in Mautic 7 API v2 (API Platform). Roles with owner-scope restrictions (e.g., `viewown`, `editown`) are not properly enforced, allowing low-privilege authenticated users to access or modify resources belonging to other users.

A CWE-78 OS Command Injection vulnerability was identified in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040. Attackers with access to the TX Host can execute code on the RX Host when a MySQL connector is configured.

A CWE-23 Relative Path Traversal (Zip Slip) vulnerability in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040 allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled.

CWE-78 (OS Command Injection) vulnerability in the Administration WebUI of Waterfall WF-500 RX Host version 7.9.1.0 R2502171040. A remote authenticated attacker can execute arbitrary operating system commands on the host.

A CWE-125: Out-of-bounds Read vulnerability was identified in Waterfall WF-500 RX Host version 7.10.0.0 R2601141040. It allows attackers with access to the TX Host to execute code on the RX Host.