CVE Vulnerability Catalog

Affected devices do not properly validate and sanitize PLC/station name rendered on the communication parameters page of the web interface. This allows an authenticated attacker authorized to download a TIA project into the product to inject malicious scripts. If a benign user with appropriate rights accesses the page, the malicious code executes in their session context.

A vulnerability in SIMATIC CN 4100 (versions prior to V5.0) allows unauthenticated attackers to exhaust resources via unrestricted connections. This can disrupt normal device operations.

CVE-2025-6577 describes an improper neutralization of special elements used in SQL commands, leading to SQL injection vulnerability in Akilli Commerce Software. This issue affects the E-Commerce Website versions before 4.5.001.

A vulnerability in RUGGEDCOM ROX allows an authenticated remote attacker to inject commands into the task scheduler via the Web UI. Lack of proper input sanitization enables arbitrary command execution with root privileges.

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution.

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization.

In DeepChat, prior to version 1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. An attacker can exploit this vulnerability to execute arbitrary JavaScript by manipulating SVG elements.

DeepChat prior to version 1.0.4-beta.1 is vulnerable to an arbitrary protocol execution bypass, potentially leading to remote code execution (RCE). The issue arises from improper sanitization of Electron pop-up window handlers, allowing an attacker to intercept a malicious URL.

Prior to 5.0.0, oxyno-zeta/s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The middleware evaluates patterns against the percent-encoded request URI while the bucket handler builds S3 object keys from the decoded path, and combined with glob matching across path separators this allows unauthenticated attackers to read, write, or delete objects in protected S3 namespaces.

In versions prior to 0.1.57, SOCFortress CoPilot contained a hardcoded JWT signing secret, allowing attackers to forge admin-scoped tokens. If JWT_SECRET is not set, all authentication tokens are signed with this publicly known key.

The FireFighter incident management application has a vulnerability that allows access to the POST /api/v2/firefighter/raid/jira_bot endpoint without authentication. This enables unauthorized users to coerce the fetching of arbitrary URLs and submit them as attachments to Jira tickets.

Flowise is a drag & drop user interface to build customized large language model flows. In versions prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients, creating a security vulnerability.

HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization.

In pgAdmin 4 server mode, multiple endpoints fetched user-owned objects without filtering by the requesting user's identity, allowing an authenticated user to access another user's private servers, server groups, background processes, and debugger arguments by guessing object IDs. The Shared Servers feature had additional issues including credential leakage, privilege escalation via writable passexec_cmd enabling arbitrary command execution, and owner-data corruption.

Angular Expressions, used in the Angular.JS framework, prior to version 1.5.2, allowed an attacker to write a malicious expression that could escape the sandbox and execute arbitrary code on the system.

Grav is a file-based web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login plugin accepts attacker-controlled groups and access fields from the registration POST data without server-side validation.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, there was a Path Traversal vulnerability in the FormFlash core component, allowing unauthenticated attackers to manipulate the filesystem.

Grav is a file-based web platform. Prior to version 2.0.0-beta.2, an authenticated user with administrative privileges could achieve Remote Code Execution (RCE) by uploading a specially crafted ZIP file through the 'Direct Install' tool.

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0 contain a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for the attacker.