CVE Vulnerability Catalog

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

In @fastify/aws-lambda version 6.4.0, the decoration of Fastify requests with request.awsLambda.event and request.awsLambda.context is populated based on client-controlled HTTP headers (x-apigateway-event and x-apigateway-context) instead of the trusted internal token. An unauthenticated attacker can set a single HTTP header and forge the entire Lambda proxy event, including the authorizer context, leading to full authentication and authorization bypass and privilege escalation. Only version 6.4.0 is affected; the fix is in version 6.4.1.

A vulnerability in the XML::Sig library for Perl (versions before 0.71) allows signature wrapping via duplicate ID. The _get_signed_xml() function selects the first node from the XPath result set, enabling an attacker to substitute the content of a signed document.

XPath injection vulnerability in XML::Sig for Perl before version 0.71. The verify() and _get_signed_xml() functions build XPath expressions without proper escaping of the URI value from the document, allowing injection of arbitrary XPath operators.

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass. The _verify_encrypted_assertion function accepts a decrypted assertion without a signature, enabling an attacker to send an unsigned assertion encrypted with the SP's certificate and authenticate as any user.

Menulux Software Inc. Mobile App through version 12.05.2026 contains an authorization bypass vulnerability through a User-Controlled key, allowing a Software Integrity Attack.

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) allows an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system.

In Wapt Server before version 2.6.1.17813, a remote unauthenticated attacker can bypass security restrictions using a specially crafted packet and retrieve a valid session token for the targeted account.

In Wavlink WL-NU516U1 (version 708c073-mt7628), the change_password function in nas.cgi has a stack-based buffer overflow via the User1Passwd argument. The attack can be executed remotely, and the exploit is publicly available.

In Wavlink WL-NU516U1 (version 708c073-mt7628), the fgets function in nas.cgi has a stack-based buffer overflow via the CONTENT_LENGTH argument. Remote exploitation is possible.

The 'Import and export users and customers' WordPress plugin before version 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

The 'Link Library' WordPress plugin before version 7.9.3 does not properly sanitize and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The 'ChamaWP' WordPress plugin before version 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

The 'Personal QR Message' WordPress plugin through version 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

The 'Insert or Embed Articulate Content into WordPress' plugin through version 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.