CVE Vulnerability Catalog

A security vulnerability was detected in Wavlink WL-WN570HA1 (R70HA1 V1410_221110) in the set_sys_cmd function of /cgi-bin/adm.cgi. Manipulating the command argument leads to command injection, remotely exploitable. The exploit is public, and the vendor confirmed removal of the firmware; the product is no longer supported.

A weakness was identified in Wavlink WL-WN570HA1 (R70HA1 V1410_221110) in the set_sys_adm function of /cgi-bin/adm.cgi. Manipulating the Username argument leads to command injection, remotely exploitable. The exploit is public, and the vendor confirmed removal of the firmware; the product is no longer supported.

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2 in the _checkValForAPI function of htdocs/expedition/class/expedition.class.php. Manipulation of the fields argument leads to SQL injection, and the attack can be carried out remotely, though it requires high complexity.

A vulnerability was found in eyeo Adblock Plus up to 4.36.2 on Chrome. Affected is the postMessage function in premium.preload.js of the Legacy Premium Activation component. Manipulation results in improper access controls. The exploit has been made public and could be used.

In the Edimax BR-6428nC router up to version 1.16, manipulation of the pppUserName/pptpUserName argument in the /goform/setWAN file of the web interface leads to command injection. The attack can be initiated remotely, and a public exploit is available that could be used in attacks. The vendor was contacted early but did not respond.

A security flaw was discovered in Edimax BR-6208AC 1.02 in the setWAN function of /goform/setWAN (L2TP Mode component). Manipulating the L2TPUserName argument results in command injection, remotely exploitable. The exploit is public, and the vendor did not respond to the disclosure.

A security vulnerability was detected in jsbroks COCO Annotator up to 0.11.1 affecting the Dataset API component (backend/webserver/api/datasets.py). Manipulation of the DatasetId argument leads to authorization bypass, and the attack may be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.

A path traversal vulnerability was found in COCO Annotator up to version 0.11.1. The issue affects an unknown function in the file backend/webserver/api/datasets.py of the Data Endpoint component. Manipulating the folder argument allows a remote attack.

A vulnerability was identified in YunaiV yudao-cloud up to 2026.01 affecting the getDataBySQL function in GoViewDataServiceImpl.java, leading to SQL injection. The attack can be launched remotely and the exploit is publicly available. The vendor states this item is not reported as patched.

In kerwincui FastBee up to 1.2.1, the ToolController.download function in ToolController.java of the Tool Download Endpoint component, when manipulating the fileName argument, leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present, whereas per RFC 7230 3.3.3 Transfer-Encoding must take precedence.

A vulnerability was detected in youlai-boot up to 2.21.1 in the getUserList function of UserController.java (Users Endpoint). Manipulation of the order argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly disclosed.

In sgl-project SGLang up to 0.5.9, the get_tokenizer function in hf_transformers_utils.py of the HuggingFace Transformer Handler component, when trust_remote_code=False is passed, may silently re-invoke AutoTokenizer.from_pretrained with trust_remote_code=True if transformers v5 returns a TokenizersBackend. This can lead to arbitrary Python code execution from a malicious tokenizer.py in a model repository. The issue affects all SGLang versions due to transformers==5.3.0 being pinned.

A security flaw was discovered in r-huijts mcp-server-rijksmuseum up to 1.0.4 in the open_image_in_browser function of src/index.ts (MCP Interface component). Manipulating the imageUrl argument results in OS command injection, remotely exploitable. The exploit is public, and the project has not responded.

A vulnerability was found in ruvnet sublinear-time-solver 1.5.0 affecting the export_state function (src/consciousness-explorer/mcp/server.js) in the MCP Interface component. Input manipulation results in path traversal, and the attack can be executed remotely. The exploit has been made public and the project has not responded.

A flaw was found in ChatGPTNextWeb NextChat up to 2.16.1 affecting an unknown function of the Next.js file in the API Endpoint component. Manipulation can lead to a permissive cross-domain policy with untrusted domains, and the attack may be launched remotely.

A vulnerability was detected in pskill9 website-downloader up to 0.1.0 in the download_website function of src/index.ts (MCP Interface component). Manipulating the outputPath argument results in OS command injection, remotely exploitable. The exploit is public, and the project has not responded.

A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. It affects the setUploadSetting function in /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument leads to file inclusion. The attack may be performed remotely, and the exploit is publicly available and might be used.

A vulnerability was found in code-projects Online Hospital Management System 1.0 in the Registration Handler component where manipulation of the Username argument leads to improper authorization. The attack can be executed remotely and the exploit is publicly available.

A flaw was found in kleneway awesome-cursor-mpc-server up to 2.0.1 in the runCodeReviewTool function of src/tools/codeReview.ts (Code-Review Tool component). Manipulation leads to command injection, remotely exploitable. The exploit is public, and the project has not reacted.