CVE Vulnerability Catalog

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.

A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.

The vulnerability causes sensitive information such as passwords and charging card UIDs to be written to log files. This can lead to unauthorized access to this data by individuals with log access.

The firmware update mechanism lacks cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files, potentially leading to arbitrary code execution.

The web server on port 8090 does not require authentication, allowing sensitive information leakage such as configured passwords and file uploads through various endpoints.

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.

The EVbee Service Android app uses TLS encrypted communication but does not validate the server certificate, allowing an attacker on the network path to intercept and manipulate the communication. The traffic is weakly encrypted using RC4 with a hardcoded key, enabling an attacker to gain access to the data, including charging station access codes.

A vulnerability in Thales CERT "Suspicious" application version 1.3.4 and earlier allows a remote, unauthenticated attacker to execute arbitrary code and overwrite writable application files, including Python modules, configuration files, cron inputs, and runtime artifacts. This leads to persistent denial of service, potential compromise of application secrets or integrations, and root-level execution inside the Django application container.

A critical Server-Side Template Injection (SSTI) vulnerability in Centreon's centreon-open-tickets module. The message_confirm field is stored unsanitized and rendered via Smarty without security policy, allowing any authenticated user to inject and execute arbitrary code on the server.

The Joomla extension Helix Ultimate below version 2.2.7 is vulnerable to unauthenticated arbitrary file deletion. An attacker without logging in can delete any file on the server.

In WAGO System I/O Field series devices, an internal diagnostic capability activates during the initial startup sequence. It is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to internal system processes, resulting in full system compromise.

The User Registration & Membership WordPress plugin before version 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them. This allows unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.

A vulnerability was found in Comfast CF-WR631AX V3 up to version 2.7.0.8, involving OS command injection in the system_wl_upload_pic_file function within /usr/bin/webmgnt (FastCGI Backend). The filename argument is improperly sanitized, allowing remote exploitation. The exploit has been publicly disclosed.

Flowise before version 3.1.0 (versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware. When the corresponding environment variables are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators.

Crawl4AI before version 0.8.7 has an arbitrary file write vulnerability in the /screenshot and /pdf endpoints of the Docker API server. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to overwrite server files and cause denial of service.

PraisonAI before version 1.6.78 contains a remote code execution vulnerability in the CodeAgent._execute_python() function, which executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.

PraisonAI before version 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component. Missing path validation and command sanitization in LLM tool calls allow attackers to inject malicious prompts through the chat interface.

A vulnerability in PraisonAI before version 4.6.78 allows SQL/CQL injection due to improper validation of the dimension argument in PGVector and Cassandra backends. An attacker can pass a malicious string that is directly interpolated into the CREATE TABLE query, potentially leading to unauthorized database operations.

Unauthenticated arbitrary file upload vulnerability in Joomla extension RSFiles (< 1.17.12) allowing full remote code execution.

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.