CVE Vulnerability Catalog

e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.

Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.

Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler. Attackers can send POST requests to the com_baforms component with malicious JSON in the 'id' parameter to execute arbitrary SQL queries.

Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the product_id parameter. Attackers can use time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc_user table.

EFM ipTIME A8004T router version 14.18.2 has a stack-based buffer overflow vulnerability in the formWifiBasicSet function in /goform/WifiBasicSet via manipulation of the security_5g argument. The attack can be performed remotely, and the exploit is publicly available.

Vulnerability in PHP (versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6) in the DOMNode::C14N() method causes incorrect XML processing, resulting in a circular linked list in the XML document's data structure. This may cause an infinite loop during subsequent processing, leading to denial of service (DoS).

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function uses a signed int variable to track the position in the input string. Passing a string longer than 2,147,483,647 bytes causes a signed integer overflow, leading to undefined behavior, out-of-bounds read, segmentation fault, and potential availability impact on the PHP process.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of a missing value element. This leads to dereferencing a NULL pointer, causing a segmentation fault, allowing a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, functions like urldecode() pass signed char to ctype functions (e.g., isxdigit()). On systems with default signed char and optimized table-lookup ctype functions (e.g., NetBSD), this can lead to array access with negative offset, potentially causing denial of service.

A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03 affecting the function iasServerRemoteInterface.doAction of the Java RMI Session Management component. This manipulation leads to improper authentication. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond.

AzuraCast before version 0.23.6 has a vulnerability in the ApplyXForwarded middleware that unconditionally trusts the X-Forwarded-Host header without a trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL by injecting this header during the forgot-password flow. When the victim clicks the link, the reset token is exfiltrated, allowing full account takeover and destruction of 2FA configuration.

A vulnerability in AzuraCast prior to version 0.23.6 allows an authenticated user with media management permissions to write arbitrary files outside the station's media storage directory via an unsanitized currentDirectory parameter in the Flow.js upload endpoint. This can lead to remote code execution by writing a PHP webshell.

apko, a tool for building OCI container images from apk packages, prior to version 1.2.7 verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images.

Vulnerability in apko (versions 0.14.8 through before 1.2.5) allows a crafted .apk to install a TypeSymlink tar entry pointing outside the build root. Subsequent entries in the archive can traverse that symlink to reach host paths the build user can write to.

Plainpad prior to version 1.1.1 allows a low-privilege authenticated user to escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input.

In the Net::IMAP library for Ruby prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause the starttls method to return 'successfully' without actually starting TLS.

Net::IMAP in Ruby has quadratic time complexity when reading large responses containing many string literals. A hostile server can send crafted responses to exhaust the client's CPU, leading to a denial of service (DoS) attack.

Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.

A vulnerability in discontinued Hikvision switch products (discontinued since December 2023) allows authenticated remote command execution due to insufficient input validation.

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.