CVE Vulnerability Catalog

PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_sql.php. The status_sql.php endpoint constructs SQL UPDATE queries by directly concatenating user-controlled sw1 and sw2 parameters without using parameterized queries or pg_escape_string().

pypdf prior to version 6.4.0 allows an attacker to craft a PDF that leads to memory usage of up to 1 GB per stream when parsing the content stream of a page using the LZWDecode filter.

The Files module for managing files in spaces and user profiles, prior to versions 0.16.11 and 0.17.2, has insufficient authorization checks allowing non-member users to create folders and upload/download files as a ZIP archive in public spaces. Private spaces are not affected.

Formwork, a flat file-based CMS, prior to version 2.2.0 allows insertion of unsanitized data into the blog tag field, resulting in stored XSS. Any user with Formwork credentials who views or edits an affected blog post will have attacker-controlled script executed in their browser.

In NanoMQ before version 0.22.5, a heap-use-after-free vulnerability exists in the TCP transport component (src/sp/transport/mqtt/broker_tcp.c), due to improper resource management and premature cleanup of message and pipe structures under specific malformed MQTTV5 retain message traffic conditions.

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly runtime. Prior to version 2.4.4, an out-of-bounds array access issue exists in WAMR's fast interpreter mode during WASM bytecode loading, involving the frame_ref_bottom and frame_offset_bottom arrays. It has been patched in version 2.4.4.

WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, WAMR is susceptible to a segmentation fault in the v128.store instruction. This issue has been patched in version 2.4.4.

A reflected cross-site scripting (XSS) vulnerability exists in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the captive-portal endpoint selfguestpass/guestAccessSubmit.jsp. Attackers can inject malicious code that executes in the user's browser.

GeoServer prior to version 2.25.0 contains a reflected cross-site scripting (XSS) vulnerability in the WMS GetFeatureInfo HTML output format, enabling a remote attacker to execute arbitrary JavaScript code in a victim's browser via specially crafted SLD_BODY parameters. This issue has been patched in version 2.25.0.

Insecure Direct Object Reference (IDOR) in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter.

Contao CMS from version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5 allows back end users with precise control over template closure contents to execute arbitrary PHP functions that do not have required parameters. This is patched in versions 4.13.57, 5.3.42, and 5.6.5.

API endpoints in Primakon Pi Portal 1.0.18 responsible for retrieving object-specific or filtered data fail to implement sufficient server-side validation to confirm that the requesting user is authorized to access the requested object or dataset. This vulnerability can be exploited via direct ID manipulation (IDOR) or by omitting the filtering parameter, leading to unauthorized exposure of sensitive personal and organizational information.

Multiple SQL injection vulnerabilities were discovered in SIGB PMB version 8.0.1.14 in the /opac_css/ajax_selector.php component. The flaws exist in the id and datas parameters.

The /api/v2/users endpoint in Primakon Pi Portal 1.0.18 is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of privilege level, can retrieve a complete list of all registered users, including password hashes.

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding a slice that uses the compromised module.

A flaw in Keycloak's LDAP User Federation provider allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.

A path traversal vulnerability has been identified in certain router models. A remote, authenticated attacker could exploit this vulnerability to write files outside the intended directory, potentially affecting device integrity.

A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could exploit it to potentially execute arbitrary SQL queries, leading to unauthorized data access.

An integer underflow vulnerability has been identified in Aicloud. An authenticated attacker may trigger it by sending a crafted request, potentially impacting device availability.

A stack buffer overflow vulnerability has been identified in certain router models. An authenticated attacker may trigger this vulnerability by sending a crafted request, potentially impacting the availability of the device.