CVE Vulnerability Catalog

A Code Injection vulnerability in Logsign SIEM (before 6.4.115) allows code injection.

PHP Jabbers Car Rental Script before version 4.1 contains a SQL injection vulnerability in sorting parameters, allowing an unauthenticated attacker to perform SQL injection attacks.

DMS+ (Non-Mobile) by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

The ShopMonitor.io WordPress plugin before version 1.2.0 improperly restricts its email-rerouting test mode, relying on client-supplied request headers. Unauthenticated attackers can redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0. Missing file type validation combined with a publicly accessible I/O endpoint authenticated solely by static default API credentials allows unauthenticated attackers to upload executable files, leading to remote code execution.

CodeIgniter prior to 4.7.4 has a vulnerability in the is_image and mime_in upload validation rules that do not enforce a safe client filename extension. A remote attacker can upload executable content if the application preserves the client filename and stores uploads in a web-accessible script-enabled directory.

CodeIgniter from 4.3.0 through 4.7.3 has a vulnerability in the Query Builder deleteBatch() method that substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing SQL injection.

A command injection vulnerability in the firmware upgrade file verification process. This could allow an attacker to execute arbitrary commands.

In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages.

Multiple router models (TR1200, TR3000, WR300, etc.) contain a command injection vulnerability in the net.set_wan interface. Attackers can execute arbitrary commands as root via crafted input.

LazyOwn RedTeam/APT Framework ships default C2 credentials in configuration files, allowing any network-reachable attacker to authenticate to the C2 dashboard with operator-level access.

LazyOwn RedTeam/APT Framework registers an unauthenticated Socket.IO input event handler that dispatches data to a function executing system commands, allowing unauthenticated remote code execution.

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads via a crafted username in a failed login request, which is rendered unsanitized in the administrator's notification panel.

Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to a default value publicly visible in the source code repository.

A vulnerability in dnsmgr version 2.15 and earlier allows a local attacker to execute arbitrary code via the ping function in the CheckUils.php file.

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.