CVE Vulnerability Catalog

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter passed unescaped into a shell command.

Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters.

Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping.

Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/.

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module. Unescaped input from the file POST parameter in the acc=deletedp action is passed directly into a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.

wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization, allowing a CREST JSON response to be interpreted as HTML and enabling execution of arbitrary JavaScript in the victim's browser.

In INFINITT PACS (INFINITT Healthcare Co., Ltd.), the IModular.exe URI handler allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command and argument parameters.

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in DataTable embedding. Attackers who can edit pages, including anonymous users under the default configuration, can read repository-internal files by setting an absolute src such as /.git/config and rendering the file as a table.

Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code. Users who can edit pages (including anonymous users under the default configuration) can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits.

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer against the thread's stack. A user-mode, memory-protected module can thereby write up to nine words into memory immediately below any region it may write, and read back what is stored there.

In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill the destination table with Packet Too Big messages quoting new destinations, after which the next message makes the IP helper thread dereference a NULL pointer.

In Krill, when a parent CA lives on the same server, the RFC 6492 provisioning exchange runs in-process instead of building and verifying a signed CMS message. The child identity (child_handle) supplied by the caller in the parent contact is trusted without verifying that it actually belongs to the requesting CA.

A role restricted to a list of CAs (cas = [...]) receives its full permission set for requests not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. This allows adding a new child CA under any existing CA, assigning it any of that CA's resources, and creating the ROAs specified in the request.

Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every restart, so the same (key, nonce) pair is reused after each restart.

Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route. Unauthenticated attackers can execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter, which is passed unescaped into a shell_exec() call.

Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes files via file_put_contents without path confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec, achieving code execution in the user panel context.

Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex). A missing exit() call after a header('Location: ...') redirect allows unauthenticated attackers to continue PHP execution past the redirect and reach user panel functionality that should require authentication.

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php. An unsanitized module name parameter is concatenated directly into an include path, allowing local file inclusion and execution of arbitrary PHP code in the user panel context.

Chainlit 2.12.0 contains a server-side request forgery vulnerability that lets unauthenticated attackers bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant.