CVE Vulnerability Catalog

An Expected Behavior Violation vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand check in the Web UI will correctly show a failure message.

A stored XSS vulnerability in the Gateway Wireless Controller module of WatchGuard Fireware OS allows injection of malicious scripts that execute in the administrator's browser.

Stored XSS vulnerability in WatchGuard Fireware OS in the Autotask Technology Integration module. Improper input neutralization during web page generation allows persistent injection of malicious script.

Stored XSS vulnerability in WatchGuard Fireware OS in the ConnectWise Technology Integration module. Improper input neutralization during web page generation allows persistent injection of malicious script.

Stored XSS vulnerability in WatchGuard Fireware OS in the Tigerpaw Technology Integration module. Improper input neutralization during web page generation allows persistent injection of malicious script.

When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet. The device may recover automatically or require a hard reset.

TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.

Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim's browser context when they visit a crafted URL.

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform, or execute system commands on the host.

The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP containing another ZIP) where the inner archive contains an executable file (e.g. webshell.php), and during extraction the executable may be placed in a web-accessible directory.

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter. The vulnerability allows injection of malicious script code.

Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This affects CareLink Network before December 4, 2025.

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user account. This issue affects CareLink Network: before December 4, 2025.

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext.

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted PDF file to viewer.html. This issue is related to CVE-2024-4367, but the root cause is that the product exposes executable example code on a same-origin basis.

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the delete function of the file /member/readHistory/delete. Manipulation of the argument ids leads to improper authorization. The attack can be executed remotely, and the exploit has been publicly disclosed.

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/deleteAll.html of the component Batch Delete Comments. Executing a manipulation can lead to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component Add Display Name Field. Performing a manipulation of the argument aid/tid results in SQL injection. The attack can be initiated remotely and the exploit has been made public.