CVE Vulnerability Catalog

In Capgo before version 12.128.2, a privilege escalation vulnerability exists where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to the stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundles across the entire organization indefinitely.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to read sensitive financial and operational metrics via the Supabase PostgREST global_stats endpoint. Using only the public API key, attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemetry.

A SQL injection vulnerability was found in the login component of SmartHomeAdatum up to commit cf495353d81b680675eb8d9aa14a318aa45ce12c. An attacker can remotely manipulate the 'Login' argument in users.php, leading to unauthorized database access. The product uses rolling releases, so no specific version numbers are available.

A remote code injection vulnerability was found in SonicCloudOrg sonic-agent up to version 2.7.2 within the JWT Authentication Filter component. The flaw resides in ExchangeController.java and can be exploited remotely. The exploit is publicly disclosed and the product is no longer supported.

A missing authentication vulnerability has been found in an unknown part of TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The flaw can be exploited remotely without authentication.

A security flaw has been discovered in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The vulnerability is an SQL injection in the proses/add.php file, where the kode_produk or kd_cs arguments can be manipulated remotely. The exploit has been publicly released and may be used in attacks.

A SQL injection vulnerability exists in the proses/login.php file of TOKO-ONLINE-ROTI (up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99) via the Username argument. Remote exploitation is possible and a public exploit is available.

A vulnerability was found in shiroiAdmin versions 1.1 and 1.3 in the FileController::upload function within app/common/controller/FileController.php. Manipulating the File argument allows unrestricted file upload, which can be exploited remotely. The exploit has been publicly disclosed.

A buffer overflow vulnerability was found in the TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. The attack can be launched remotely. The vendor states the device is End-of-Life (EOL) and will not be patched.

A buffer overflow vulnerability has been detected in TRENDnet TEW-821DAP version 1.12B01 in the sub_41EC14 function of the /goform/tools_nslookup file within the ssi component. An attacker can remotely exploit this by manipulating the nslookup_target argument. The vendor states the device is End-of-Life (EOL) and will not issue patches.

A SQL injection vulnerability has been found in Aster Telecom Azcall 10/11 in the file /azcall/adm/gestao_loja/sis.php?t=consultar. Manipulating the nome/perfil/status arguments can lead to SQL injection. The attack is remotely exploitable and the exploit has been made public.

A command injection vulnerability was discovered in Trendnet TEW-635BRM up to 1.00.03 in the ipoa_test function of /sbin/rc (IPoA WAN Connection Setup component). Manipulating the ipoa_ipaddr argument allows remote command execution. The vendor does not confirm the flaw and the device has been EOL since 2011.

A vulnerability was found in Trendnet TEW-635BRM up to version 1.00.03 in the start_httpd function of the /sbin/rc file within the Web Service component. Manipulating the device_name argument causes a stack-based buffer overflow, allowing remote exploitation. The vendor does not confirm the issue and states the device has been end-of-life since 2011.

A vulnerability was found in H3C NX15 V100R017 in the administrator password change function. Manipulating the newPass argument in requests to /api/login/modify allows setting a weak password, facilitating password recovery. The attack can be launched remotely and exploit details have been made public.

A deserialization of untrusted data vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

A vulnerability in PraisonAI Platform before version 0.1.9 allows a workspace member to modify owner-created records such as projects, issues, and agents without required owner or admin authorization. For projects, a member can reassign the lead_id to their own user ID and then delete the project, bypassing the delete route's owner/admin permission check.

A vulnerability in PraisonAI before version 4.6.78 stems from a misconfigured prompt injection defense where the default block threshold is set to CRITICAL severity. This allows HIGH-severity attacks to pass through unblocked, enabling system prompt extraction and unauthorized tool invocations.

An SSRF vulnerability in the Crawl4AI/Chromium backend of PraisonAI before version 1.6.78 allows attackers to bypass SSRF validation via DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after initial validation, enabling the headless browser to read sensitive internal responses including canary values.

PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and trigger replies to attacker-controlled addresses, bypassing sender allow/block lists.

PraisonAI before version 1.7.3 has an insecure default configuration that binds to all network interfaces, requires no API key, and allows wildcard CORS. Unauthenticated attackers can read agent instructions and system prompts via GET /api/agents or invoke agents without authentication via POST /api/chat.