CVE Vulnerability Catalog

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow in sqlite3changeset_apply(). An attacker can corrupt heap memory by supplying crafted changesets where repeating a table name in a second changeset block with a larger column count causes sessionUpdateFind() to memset past the undersized aUpdateMask allocation.

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete(). An attacker can write past the leaf page buffer via crafted footer key offsets by supplying a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. An attacker who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A low privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Argument Injection vulnerability due to improper neutralization of argument delimiters in commands. A high privileged attacker with remote access could exploit it to elevate privileges.

Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user. This issue was fixed in metric 242 in version 10.02.002.

Płatnik software uses a weak password encoding algorithm, allowing a user who obtains an encoded password to easily decode it. This issue was fixed in metric 242 in version 10.02.002.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A high privileged attacker with remote access could exploit it to execute commands.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could exploit it to elevate privileges.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an OS Command Injection vulnerability due to improper neutralization of special elements used in OS commands. A high privileged attacker with remote access could exploit it to execute commands.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection. Improper neutralization of input provided by a low privileged user into the "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection. Improper neutralization of input provided by a low privileged user into the "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in PROTECTELMAJ v6.5.19 and BDF v6.4.67.

A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

An information disclosure vulnerability in the Forocoches comments editor allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user's privacy.

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause.

The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3/staging/:guid/droplet_completed and /internal/v3/staging/:guid/build_completed are reachable from the public API listener without OAuth or mutual TLS.