CVE Vulnerability Catalog

Adobe Campaign Classic (ACC) is affected by an Eval Injection vulnerability that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this to execute arbitrary code. Exploitation does not require user interaction, and the scope is changed.

GL.iNet GL-MT3000 router up to version 4.4.5 contains a command injection vulnerability in the remove_profile function in /cgi-bin/glc of the modem.so component. The attack can be performed remotely, and the exploit is publicly available.

Tenable Sensor Proxy contains a vulnerability that allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.

Misskey, an open source federated social media platform, has a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid.

Sequelize, a Node.js ORM tool, is vulnerable to SQL injection in the Oracle dialect. The escape function fails to escape quotes when the value starts with TO_TIMESTAMP or TO_DATE, allowing arbitrary SQL injection.

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to execute arbitrary code via the application/common/controller/Backend.php component.

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.

Baileys, a socket-based TS/JavaScript API for WhatsApp Web, has a vulnerability that allows a malicious payload via placeholderResendMessage to trigger fake messages.upsert events, enabling message spoofing and app state sync corruption.

Apache NiFi 2.0.0 through 2.10.0 allows creating, reading, and deleting Assets via REST API. The framework authorizes deletion based on the Parameter Context ID without verifying Asset ownership. Installations without different authorization levels across contexts are not affected. Upgrade to 2.11.0 fixes the issue.

Apache NiFi versions 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. An authenticated user authorized to modify a Parameter Context but not authorized on referencing components can alter Parameter values affecting those components. If a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation. The issue applies only to deployments using component-level authorization policies. Upgrade to Apache NiFi 2.11.0 is recommended.

go-base, a Go RESTful API Boilerplate with JWT Authentication, has a hardcoded JWT signing secret "random". Any attacker can read this secret from the public repository and forge tokens for any user, including admins, completely bypassing authentication.

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing with low-entropy inputs like timestamp and client IP. This allows an attacker to brute-force the key within a feasible time window.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the server.set_peer function of /cgi-bin/glc in the wg-server.so component. Manipulating the public_key argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the wg-server.generate_publickey function of /cgi-bin/glc in the wg-server.so component. Manipulating the private_key argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the s2s.enable_echo_server function of /cgi-bin/glc in the s2s.so component. Manipulating the port argument allows remote command execution.

GL-iNet GL-MT3000 up to version 4.4.5 has an injection vulnerability in the plugins.set_config function of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote code execution.

GL-iNet GL-MT3000 up to version 4.4.5 has a command injection vulnerability in the plugins.remove_package and plugins.install_package functions of /cgi-bin/glc in the plugins.so component. Manipulation leads to remote command execution.

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user.