CVE Vulnerability Catalog

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities in the artid, cid, did, contid, and aboutid parameters in mod.php. Unauthenticated attackers can send crafted requests to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and version details.

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20 in the formSetFirewallRule function. Manipulating the firewall_name argument causes a stack-based buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor states the product is EOL since 2009 and will not be fixed.

A stack-based buffer overflow vulnerability was found in the TRENDnet TEW-432BRP router version 3.10B20 in the formSetMACFilter function of the /goform/formSetMACFilter file. Remote attack is possible by manipulating the filter_name argument. The vendor states the product has been EOL for 15 years and will not be fixed.

A use-after-free (UAF) vulnerability was found in the Linux kernel's eventpoll (epoll) mechanism. The bug occurs in ep_remove() which, after clearing the file->f_ep pointer, may still use the file structure while a concurrent __fput() can free it, leading to writes into freed memory. An attacker can exploit this to trigger a controlled kmem_cache_free() on the wrong slab cache.

The GEO my WP plugin for WordPress up to version 4.5.5 contains an SQL injection vulnerability via the 'swlatlng' and 'nelatlng' parameters, allowing unauthenticated attackers to append additional SQL queries and extract sensitive data. Exploitation requires a public page with the location search results shortcode.

A vulnerability in the Spectra Gutenberg Blocks plugin for WordPress up to version 2.19.25 allows authenticated attackers with Contributor-level access and above to execute remote code on the server via a two-block payload in post content.

Account takeover vulnerability in the Simple History plugin for WordPress. An authenticated user (Subscriber+) can read full event context, including password reset keys, via event reaction endpoints.

In sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0, an SQL injection vulnerability was found in the Login Page component. Manipulating the email argument leads to SQL injection. The attack can be performed remotely, and an exploit has been published. The project was informed early but has not responded.

The Student Details Management System 1.0 by code-projects is vulnerable to SQL injection in the /index.php file via manipulation of the roll argument. The attack can be launched remotely, and the exploit is publicly available.

Spatie Laravel Media Library before version 11.23.0 has a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery (SSRF) vulnerability. A remote attacker can force the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.

The Formie plugin for Craft CMS before versions 2.2.21 and 3.1.26 allowed unauthenticated users to modify existing submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint.

FreeScout prior to 1.8.220 has a vulnerability in the email processing pipeline where thread and user IDs are extracted from Message-ID without HMAC verification. An attacker can spoof an agent's address and inject messages treated as agent replies, which are automatically forwarded to customers.

The TIFF decoder does not limit the size of PackBits-compressed data. A maliciously crafted image can cause the decoder to decompress large amounts of data, even though the image is small in dimensions and encoded size.

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service).

The iskorotkov/avro library for Go before version 2.33.0 contains a remote denial-of-service (DoS) vulnerability. Avro block decoders do not check the reader's error state in the processing loop, allowing an attacker to send a packet with a huge number of elements, causing an infinite loop and CPU exhaustion.

The Go Avro library (iskorotkov/avro) before version 2.33.0 has multiple vulnerabilities in Avro decoders. An attacker can send attacker-controlled 64-bit values that on 32-bit platforms (GOARCH=386, arm, mips, wasm) bypass bounds checks, select wrong union branches, or cause OCF panic. Additionally, on all platforms there are cumulative-size arithmetic overflows in array/map decoders, math.MinInt negation in block headers, and make([]byte, size) with negative size in OCF blocks – all leading to panic or bypassing allocation limits.

Use-after-free/double-free vulnerability in the NDR parser of RDPEAR in FreeRDP prior to version 3.26.0. A malicious server can reuse a ref-id for multiple pointer fields, causing a double free.

In FreeRDP prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle clamped to UINT16_MAX, but performs the copy using the original cacheEntry->width/height, potentially causing a large out-of-bounds heap write and leading to client crashes or code execution.

In FreeRDP prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in the server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution.