CVE Vulnerability Catalog

Vulnerability in CP Plus Wi-Fi Camera. A physical attacker can access the UART interface and extract sensitive information from RAM, including cryptographic keys, Wi-Fi credentials, and configuration data.

Cargo incorrectly handles symbolic links inside crate tarballs downloaded from third-party registries, allowing a malicious crate to overwrite the source code of another crate from the same registry. The vulnerability is medium severity for users of third-party registries; crates.io users are not affected because crates.io forbids uploading crates containing symlinks.

Cargo between versions 1.68 and 1.96 incorrectly normalized URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries with arbitrary names in the same domain, an attacker could obtain credentials of other users. Severity is low due to niche requirements.

In Acer Care Center, the ACCSvc service creates a Named Pipe with a weak Security Descriptor. An authenticated local user can connect and send a specially crafted message (type 0x03), causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED).

A vulnerability in Edimax BR-6478AC 1.23. The formAccept function in /goform/formAccept of the POST Request Handler component allows command injection via the submit-url argument. Remote attack possible, exploit public.

A vulnerability in Edimax BR-6675nD 1.12. The stainfo function in /goform/stainfo allows command injection via the interface argument. Remote attack, exploit public.

In the StudentManagementSystem project (commit cb2f558d), a vulnerability exists in courseDel.php. Manipulation of the ID argument leads to improper control of resource identifiers, enabling remote attack. The exploit has been published.

A vulnerability in DTStack Taier 1.4.0. The Runtime.exec function in the REST API component allows OS command injection via the sqlText argument. Remote attack, exploit public.

In Mattermost versions 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14, nil elements are not filtered from outgoing webhook attachment payloads before processing. An authenticated user can cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.

An XSS vulnerability in Apache ECharts tooltip rendering for Lines series. Without a custom formatter, HTML in data point names is rendered unescaped, potentially leading to script execution.

In Spring AI versions 1.1.0 through 1.1.x, support for Anthropic's Skills API uses LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.

A vulnerability has been found in Edimax EW-7438RPn version 1.31, allowing OS command injection in the formWlanMP function of the /goform/formWlanMP file. The attack can be launched remotely by manipulating multiple arguments.

In the Edimax BR-6675nD router version 1.12, the mp function in the POST Request Handler component in file /goform/mp is vulnerable to command injection via the command argument. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in KLiK SocialMediaWebsite 1.0 in the HTTP GET Request Parameter Handler component. Manipulation leads to injection.

A Cross-Site Scripting (XSS) vulnerability was found in code-projects Employee Management System 1.0 in an unknown function of /empproject.php via the ID argument. Remote attack is possible, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /changepassemp.php via the ID argument. Remote attack is possible, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofileup.php via the ID argument. Remote attack is possible, and the exploit is public.

A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofile.php via the ID argument. Remote attack is possible, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was identified in code-projects Employee Management System 1.0 in an unknown function of /eloginwel.php via the ID argument. Remote attack is possible, and the exploit is public.