CVE Vulnerability Catalog

The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring_process_registration() function.

The MoreConvert Pro plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 1.9.14. The issue arises from the guest waitlist verification flow not invalidating or regenerating verification tokens when the customer email address is changed.

Nginx UI, a web user interface for the Nginx web server, prior to version 2.3.8, exposed a backup restore endpoint (POST /api/restore) that was completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker could upload a crafted backup archive that overwrote the application's configuration file and SQLite database.

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary due to insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters, leading to persistent payloads stored in NVRAM.

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the reboot_time function of the adm.cgi binary. This allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the reboot_time POST parameter.

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary. This allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the set_time or StartSniffer functions.

The WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary, allowing unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the gateway POST parameter.

WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the wireless.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell commands by injecting malicious input into the sz11gChannel or PIN POST parameters. Attackers can exploit unsanitized parameter handling in the set_wifi_basic and set_wifi_do_wps functions to achieve remote code execution without authentication.

n8n is a workflow automation platform that prior to versions 1.123.32, 2.17.4, and 2.18.1 was vulnerable to an unauthenticated attacker registering a malicious OAuth client. After authorization by the victim, a malicious script could be executed in the victim's browser session.

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter. Attackers can supply a URL to a malicious Python file, leading to the download and execution of attacker-controlled code.

OpenC3 COSMOS prior to version 7.0.0-rc3 allows users to execute Python and Ruby scripts from the openc3-COSMOS-script-runner-api container. This enables bypassing API permissions checks and performing administrative actions, including modifying data in the Redis database.

In versions from 6.7.0 to before 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of OpenC3 COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input, allowing arbitrary SQL commands to be executed.

The Note Mark note-taking application in version 0.19.2 has a vulnerability where the IsPasswordMatch function in the backend uses a hard-coded bcrypt("null") password for users without stored passwords. OIDC-registered users are created with an empty password, allowing anyone to obtain a valid session by submitting password: "null" to the internal login endpoint.

Apache Polaris contains a vulnerability allowing a user who can change table settings to bypass storage location validation during metadata writes. Changing only the `write.metadata.path` property via an `ALTER TABLE`-style change skips the commit-time validation branch, potentially causing Polaris to write metadata to an attacker-chosen location and later vend credentials for that location.

Apache Polaris issues short-lived GCS credentials with a CEL-based path restriction built without escaping the namespace or table identifier. A crafted identifier containing a single quote and CEL fragments can break out of the quoted string and broaden the credentials to the entire configured bucket. This was confirmed in testing against Polaris 1.4.0 with real Google Cloud Storage.

Apache Polaris accepts literal `*` characters in namespace and table names and later reuses them unescaped in S3 IAM resource patterns and `s3:prefix` conditions. Because `*` acts as a wildcard in S3 IAM policy matching, temporary credentials issued for a crafted table (e.g. `f*.t1`, `*.*`) can match the storage path of a different table. Confirmed behavior includes reading another table's Iceberg metadata JSON, listing its exact S3 prefix, and creating or deleting objects under it when write delegation is returned.

Apache Polaris issues broad temporary (vended) storage credentials during staged table creation before the effective table location has been validated or durably reserved. An attacker can supply a custom location (or write.data.path/write.metadata.path), making the credential scope attacker-directed.

D-Link DIR-456U Hardware Revision A1 contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot, allowing access to a root shell with full administrative control.

D-Link DIR-600L Hardware Revision A1 contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot with the default username 'Alphanetworks' and static password 'wrgn35_dlwbr_dir600l'.

D-Link DIR-600L Hardware Revision B1 contains a hardcoded telnet backdoor. The device starts a telnet daemon at boot with the username 'Alphanetworks' and the static password 'wrgn61_dlwbr_dir600L'.