CVE Vulnerability Catalog

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.

W podatności CVE-2025-10466 występuje niewłaściwe neutralizowanie danych wejściowych podczas generowania stron internetowych w Safe Access w Synology Safe Access przed wersją 1.3.1-0329. Umożliwia to zdalnym użytkownikom z uprawnieniami administratora odczyt lub zapis określonych plików zawierających niesensytywne informacje oraz przeprowadzenie ograniczonego ataku typu denial-of-service w SRM.

W podatności CVE-2024-11399 w komponencie redis-server w Synology BeeDrive dla systemu desktop przed wersją 1.3.2-13814, lokalni użytkownicy mogą uzyskać dostęp do plików lub katalogów, co umożliwia przeprowadzenie ataków typu denial-of-service za pomocą nieokreślonych wektorów.

The description indicates a Cross-site request forgery (CSRF) vulnerability that allows an attacker to exploit a user's authenticated session to forge cross-site requests. This can induce unintended operations such as tampering with configuration data.

CVE-2026-41704 affects BOSH Director, where the AgentClient#handle_method processes NATS replies, leading to unauthorized access to resources in the blobstore. The lack of proper checks, such as UUID format validation, ownership verification, and namespace prefix checks, allows unauthorized deletion of resources.

CVE-2026-41009 affects BOSH Director, where the agent's response to long-running requests may lead to unauthorized access to system files. Due to the lack of normalization of the blob identifier, it is possible to reference files outside the blobstore root.

A SQL Injection vulnerability in the dsgvo_contracts view arises from improper neutralization of special elements in a SQL SELECT command. A high privileged remote attacker can read the entire database.

An SQL Injection vulnerability in the devices parameter of the accountstatus view is caused by improper neutralization of special elements in a SQL UPDATE command. A high privileged remote attacker can read the whole database and change values in a non critical table.

An SQL Injection vulnerability in the userid parameter of the accountstatus view is caused by improper neutralization of special elements in a SQL UPDATE command. A high privileged remote attacker can read the whole database and change values in a non critical table.

An SQL Injection vulnerability in the DevSerialReset function is caused by improper neutralization of special elements in a SQL UPDATE command. A high privileged remote attacker can read the whole database and change values in a non critical table.

A SQL Injection vulnerability in the DevSerialReset function arises from improper neutralization of special elements in a SQL SELECT command. A high privileged remote attacker can read the entire database.

A SQL Injection vulnerability in the getAccountByID function arises from improper neutralization of special elements in a SQL SELECT command. A high privileged remote attacker can read the entire database.

The CM Ad Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.7. Missing nonce validation in the cmac_campaigns_action function allows unauthenticated attackers to permanently delete arbitrary advertising campaigns, including their associated banner records and uploaded files.

The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.

The Yoast SEO plugin for WordPress up to version 26.5 is vulnerable to Insecure Direct Object References (IDOR) in the Meta Search REST API endpoint. It lacks proper authorization checks to verify post ownership, allowing authenticated attackers with Contributor-level access or higher to read sensitive SEO metadata from any post on the site, including other users' posts, private posts, and drafts.

The Splide Carousel Block plugin for WordPress up to version 1.7.1 is vulnerable to stored XSS via the 'url' attribute in blocks. Authenticated attackers with contributor-level access can inject scripts, but require approval from an editor or administrator.

Attackers inject malicious scripts (e.g., JavaScript) into the target system. When other users visit infected pages, the scripts execute in their browsers, enabling cookie theft, session hijacking, and content tampering.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0 (including 9.3.x and 8.3.x) expose Hadoop cluster credentials in plain text through the Cluster Test API. Users can leverage these credentials to submit jobs via the backend API.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, do not apply ACLs on certain API endpoints related to platform mail notifications.

Vulnerability in IO::Uncompress::Unzip for Perl before version 2.215. An uncaught exception when parsing a ZIP header with a malformed DOS date causes a crash.