CVE Vulnerability Catalog

A high-privileged remote attacker can upload a .php file and request it directly from /uploads to achieve arbitrary code execution due to improper file type validation.

Joomla extension Phoca Cart 5.0.0-6.1.7 has a stored XSS vulnerability via User-Agent header in the admin order view.

Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.

An OS command injection vulnerability in vsDesk allows an authenticated attacker with admin privileges to execute arbitrary OS commands due to insufficient input filtering.

In affected versions of Octopus Server, sensitive variables may be printed in clear-text in the deployment variable snapshot under certain circumstances.

The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate file types during import and does not remove malformed uploads, allowing editor-level users to write arbitrary files (including executable PHP) to a web-accessible directory, leading to remote code execution.

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue.

A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crafted HTTP request to trigger a crash of the HTTP service process.

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

A crash in the X.509IF protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

A crash in the C12.22 protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

A crash in the RRC protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

A crash in the C12.22 protocol dissector in versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

A vulnerability in chenhg5 cc-connect up to 1.4.1 in the shellExecCommand function of core/engine.go in the Management API allows remote OS command injection via the exec argument. The exploit is publicly available.

A vulnerability in chenhg5 cc-connect up to 1.4.1 in the Authenticate function of core/webhook.go allows remote code injection via the exec argument. The exploit is publicly available.

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the all_projects parameter is set to false. A non-admin user with the reader role can list alarms from all projects, exposing sensitive data. Additionally, OpenStack Watcher does not enforce authorization on its webhook trigger endpoint, allowing authenticated users to start EVENT audits.

PythonTools in Agno (libs/agno/agno/tools/python.py) contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument to read_file, save_to_file, or run_python_file actions. The attack can be performed via direct tool invocation or via prompt injection in agent-processed content.