CVE Vulnerability Catalog

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ip_address parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection.

In the EcoOnline EHS (com.airsweb.v10) Android application, version 0.2.499, a remote attacker can obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component.

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.

The endpoint '/ws/apiprensa/getVideoUltimasSeccion' contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and cause database errors, exposing the internal logic of the queries.

The endpoint '/ws/apiprensa/getVideoNextPrev' is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database error messages and exposes the internal structure of the queries.

The '/ws/apitribuna/setVisita' endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of queries, causing database errors and potentially manipulating visit tracking records.

SQL injection vulnerability in the '/ws/apiprensa/getVideoSubcanal' endpoint due to improper handling of the id_video parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes internal file paths and complete stack traces through the Slim framework's error handler, increasing severity.

Multiple Zbtlink and other devices (including WE1326, WE357, WE5926, WE826-Q, WG108, WG3526, CTN720-W1, LF-1541, MT7620N, WRC1) with specific firmware versions contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Multiple devices (including Zbtlink L3_V2_8, WE826-T2, ZBT-7628, ZBT-ZBT7621, MoreQuick MQAC-7620, AP522, AP7628, HC5661A, APG721B, HK300, MAP-N10) with specific firmware versions ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root, modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

The Hash Form plugin versions up to 1.4.1 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

The Beautiful Taxonomy Filters plugin versions up to 2.4.6 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.

The Geo Controller plugin versions up to 8.9.8 contain an unauthenticated PHP Object Injection vulnerability. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

The Fluent Boards Pro plugin versions up to 2.0.11 contain an arbitrary file upload vulnerability exploitable by users with the editor role. This can lead to execution of malicious code on the server.

The Epayco plugin versions up to 8.4.6 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.

In Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, which may result in Stored XSS, Privilege Escalation, or SSRF.

The ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63 contain an unauthenticated privilege escalation vulnerability. An attacker can gain higher privileges in the system.

The Visitor Traffic Real Time Statistics Pro plugin versions up to 11.17 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.

The Joomla Event Manager extension versions below 5.0.1 contain a privileged remote code execution vulnerability. The administrator can write dangerous file types including PHP, leading to remote code execution.

The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it. Users with a role as low as subscriber can delete arbitrary files on the server.