CVE Vulnerability Catalog

A vulnerability was detected in PrefectHQ prefect up to 3.6.21 in the endswith function of /api/health (Health Check API component). Manipulation results in improper authentication, and the attack can be carried out remotely. The exploit is public; the fix is in version 3.6.22 (commit e21617125335025b4b27e7d6f0ca028e8e8f3b79).

In Totolink WA300 5.2cu.7112_B20190227, the NTPSyncWithHost function in /cgi-bin/cstecgi.cgi allows command injection through manipulation of the hostTime argument. The attack can be executed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in Totolink WA300 (version 5.2cu.7112_B20190227) in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Manipulating the langType argument leads to command injection, and the attack can be performed remotely. The exploit has been publicly released and may be used.

A vulnerability was identified in Totolink WA300 (version 5.2cu.7112_B20190227) in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. Manipulating the webWlanIdx argument leads to command injection, and the attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

In mcp-server-arangodb up to 0.4.7, the arango_backup function in src/tools.ts within the MCP Interface is vulnerable to path traversal via manipulation of the outputDir argument. The attack can be launched remotely, and the exploit has been publicly disclosed. The project was notified but has not responded.

A flaw was found in crocodilestick Calibre-Web-Automated up to 4.0.6 in unknown functionality of cps/cwa_functions.py (Admin Endpoint component). Manipulation causes missing authentication, and the attack can be initiated remotely. The exploit has been published and may be used; the project was informed but has not reacted yet.

A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. A specially crafted HTTP request can lead to credentials leak.

A vulnerability was detected in Calibre-Web-Automated up to 4.0.6 in the generate_auth_token function of the file cps/kobo_auth.py (Kobo auth-token Route component). The manipulation results in improper authorization. The attack may be performed remotely and the exploit is now public.

Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel. This allows a compromised or rogue Velociraptor client to crash the server via out-of-memory (OOM) by sending crafted messages through the normal client communication channel.

A vulnerability was identified in janeczku Calibre-Web up to 0.6.26 in the generate_auth_token function of cps/kobo_auth.py. Manipulation of the user_id argument leads to improper authorization, and the attack can be launched remotely.

A flaw was found in JD Cloud JDCOS 4.5.1.r4518 in the set_iptv_info function of /jdcap (Service Interface component). Manipulating the vid argument leads to command injection, remotely exploitable. The exploit is public, and the vendor did not respond to the disclosure.

A vulnerability has been found in AV Stumpfl Pixera Two Media Server up to 25.1 R2 in an unknown function of the Service Port 1338 component, leading to path traversal. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in toeverything AFFiNE up to 0.26.3 affecting the allowDocPreview function of the file /workspace/:workspaceId/:docId in the Public Markdown Preview Endpoint component, resulting in authorization bypass. The exploit is now public and may be used.

In Telegram Desktop up to 6.7.5, the RequestButton function in url_auth_box.cpp of the Bot API component, when manipulating the login_url argument, leads to a null pointer dereference. The attack can be initiated remotely and the exploit has been publicly disclosed. There is ongoing doubt about the real existence of this vulnerability, and the vendor states it only causes a one-time crash without security consequences.

A weakness has been identified in langflow-ai langflow up to version 1.10.2. The eval function in the file src/lfx/src/lfx/components/llm_operations/lambda_filter.py of the LambdaFilterComponent is affected by code injection. The attack may be performed remotely, and the exploit has been made public.

A security flaw was discovered in Dromara MaxKey up to 3.5.13 in the StrUtils.checkSqlInjection function of StrUtils.java. Manipulating the filtersfields argument results in SQL injection. The attack can be carried out remotely and the exploit is publicly available.

A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0 in an unknown function of the file /manager/card/cardhand_submit.php. Manipulation of the argument ID causes SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0 in /SubstationWEBV2/main/uploadH5Files. Manipulation of the File argument results in unrestricted upload, and the attack can be launched remotely.

In Wavlink WL-WN570HA1 (R70HA1 V1410_221110), manipulation of the DDNS argument in the ping_ddns function of /cgi-bin/adm.cgi results in command injection. The attack can be initiated remotely and the exploit is publicly available. The vendor confirmed the firmware version was removed from their website and the product is no longer supported.