CVE Vulnerability Catalog

In CodeAstro Online Job Portal 1.0, manipulation of the ID argument in /admin/jobs-admins/delete-jobs.php leads to SQL injection. The attack can be carried out remotely and a public exploit has been released.

D-Link DGS-3420 version 1.50.018 has a vulnerability in unspecified processing of the System Information Settings page. Manipulating the System Name argument leads to cross-site scripting (XSS). The exploit has been publicly disclosed and can be used remotely.

A flaw has been found in rawchen sims up to 004f783b1db5ecdfad81c8fdc3b34171211112de. Affected by this issue is some unknown functionality of the file sims-master/src/web/servlet/file/DeleteFileServlet.java of the component deleteFileServlet Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/database/service/database_impl.go of the component databaseTool. Performing a manipulation results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

In Datavane Datavines up to commit 13607645e14a4982468cfdbcf75c85cde63bae71, in TokenManager.java (JWT Token Handler component), manipulation of the tokenSecret argument can lead to use of a hard-coded cryptographic key. The attack is remote, highly complex, and difficult to exploit, and the exploit has been publicly disclosed.

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with the query that triggered a response.

A security flaw has been discovered in go-kratos up to version 2.9.2, affecting the NewServer function in transport/http/server.go related to the http.DefaultServeMux Fallback Handler. The manipulation results in an unintended intermediary, and the attack may be launched remotely. The exploit has been released publicly and may be used for attacks; the patch is identified as 0284a5bcf92b5a7ee015300ce3051baf7ae4718d.

A vulnerability was determined in colinhacks Zod up to 4.3.6 affecting an unknown function of the file packages/zod/src/v4/core/regexes.ts in the CUID Data Type Handler component. Manipulation can lead to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.

In Tenda F453 up to 1.0.0.3, the TendaTelnet function in /goform/telnet (Telnet Service component) does not neutralize input, leading to command injection. The attack can be launched remotely and the exploit has been disclosed to the public.

A weakness was identified in Cesanta Mongoose up to 7.20 in the handle_opt function of /src/net_builtin.c (TCP Option Handler). Manipulating the optlen argument causes an infinite loop that can be triggered remotely. The exploit is publicly available and the issue is fixed in version 7.21.

A security flaw was discovered in AstrBot up to 4.22.1 affecting the create_template function in astrbot/dashboard/routes/t2i.py (Dashboard API component). Manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely and the exploit has been released publicly.

A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0 affecting an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the API Page Sort Endpoint component. Manipulation of the pages argument can lead to SQL injection. The attack may be launched remotely.

A vulnerability was found in AiraHub2 (IhateCreatingUserNames2) up to commit 3e4b77fd7d48ed811ffe5b8d222068c17c76495e in the connect_stream_endpoint/sync_agents function of AiraHub.py. Input manipulation leads to server-side request forgery, exploitable remotely, and the exploit is publicly available.

A flaw has been found in devlikeapro WAHA up to 2026.3.4 in an unknown function of src/api/media.controller.ts (API Request Handler), causing server-side request forgery. The attack can be initiated remotely and the exploit has been published. The vendor was contacted but did not respond.

W jądrze systemu Linux zidentyfikowano podatność związaną z walidacją zagnieżdżonych nagłówków VLAN w funkcji tcf_csum_act(). Błąd polega na tym, że kod nie sprawdza, czy pełny nagłówek VLAN jest dostępny w liniowym obszarze przed jego odczytem, co może prowadzić do naruszenia zasad integralności skb.

W jądrze systemu Linux zidentyfikowano podatność w module netfilter, która dotyczy walidacji kodowania zakresu w funkcji checkentry. Funkcja ports_match_v1() błędnie traktuje niezerowe wpisy pflags jako początek zakresu portów, co może prowadzić do nieprawidłowej interpretacji reguł.

In the Linux kernel's af_alg crypto subsystem, af_alg_get_rsgl() now limits each RX scatterlist extraction to the remaining receive buffer budget. This keeps receive-side accounting consistent with the amount of data attached to the request; if skcipher cannot obtain enough RX space, the recvmsg call is rejected instead of rounding the request length down to zero.

In LangChain before version 1.1.2, an SSRF vulnerability exists in HTMLHeaderTextSplitter.split_text_from_url(). Although the initial URL is validated, redirects are not checked, allowing an attacker to access internal network resources.

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to write files outside intended output directories via absolute target names in copy_target/link_target, symlinked parent directories in save_target, or symlinked metadata filenames in SignedRole::write, because write paths trust the joined destination path without post-resolution containment verification.