CVE Vulnerability Catalog

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values when rebuilding the cross-reference table. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

W Angularze, platformie do tworzenia aplikacji webowych, zidentyfikowano podatność typu cross-site scripting (XSS) w kompilatorze szablonów. Problem wynika z niewłaściwego rozpoznawania atrybutów href i xlink:href w elementach SVG <script> jako kontekstu URL zasobów. Został on naprawiony w wersjach 19.2.18, 20.3.16, 21.0.7 oraz 21.1.0-rc.0.

KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678). The administrator cannot disable these services or change the hardcoded password, and changing the GUI password does not affect SSH/TELNET authentication.

A vulnerability was found in the D-Link DIR-605L router (hardware version F1, firmware V6.02CN02) where the UART serial interface provides root terminal access without proper access control. An attacker with physical access to the UART pins can execute arbitrary commands with root privileges.

Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller's session altogether. This issue has been patched in version 1.6.6.

An issue was discovered in Nitro PDF Pro for Windows before 14.42.0.34. In certain cases, it displays signer information from a non-verified PDF field rather than from the verified certificate subject, which could allow a document to present inconsistent signer details.

The UploadWizard extension for MediaWiki (versions 1.45, 1.44, 1.43, 1.39) contains a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker could inject malicious script code that executes in the user's browser.

Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without proper output encoding or sanitization, allowing attackers to persistently inject arbitrary JavaScript that executes in the context of other users' sessions.

Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping, allowing attackers to execute arbitrary JavaScript in the context of a victim's browser session.

Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). The application lacks proper CSRF tokens or other protective measures, allowing a remote attacker to trick authenticated users into unknowingly executing unintended actions within their session.

In GL.iNet AX1800 versions 4.6.4 and 4.6.8, the opkg-call script at /usr/libexec/opkg-call is executed with root privileges when triggered via the LuCI web interface or authenticated API calls for package management. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.

The LuCI web interface on GL.Inet AX1800 Version 4.6.4 & 4.6.8 is vulnerable. It lacks rate limiting or account lockout mechanisms on the authentication endpoint (/cgi-bin/luci), allowing an unauthenticated attacker on the local network to perform unlimited password attempts against the admin interface. Fix available in version 4.8.2.

Foomuuri contains an improper authorization vulnerability that allows arbitrary users to influence the firewall configuration. This issue affects versions before 0.31.

An improper neutralization of argument delimiters in a command (Argument Injection) vulnerability allows local users to perform arbitrary unmounts via the smb4k mount helper.

Asseco ADMX system is used for processing medical records. It allows logged-in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in version 6.09.01.62 of ADMX.

Parsl prior to version 2026.01.05 contains a SQL Injection vulnerability in the parsl-visualize component. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database.

Asseco InfoMedica stores all users' passwords in a database in an encoded format. An attacker in possession of these encoded passwords can decode them using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control. Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

CoreShop prior to version 4.1.8 contains a blind SQL injection vulnerability that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

Missing Authorization vulnerability in G5Theme Zorka allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zorka: from n/a through <= 1.5.7.