CVE Vulnerability Catalog

A missing authentication for critical function vulnerability has been reported in sMedio DTCP MOVE, which could allow remote attackers to gain access to the system. The vulnerability has been fixed in version 1.4.5 and later.

In EthereumAuthenticator, an unauthenticated client may access certain protected resources if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page, which may replace authentication or role requirements with ALLOWED.

Mitsubishi Electric products (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, MC Works64) versions 10.97.3 and prior contain an incorrect privilege assignment vulnerability. Installers grant default DCOM permissions to the administrator account, allowing an attacker to locally or remotely launch and operate DCOM objects that should require UAC elevation.

Mitsubishi Electric products (GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz) contain a weak password recovery mechanism for forgotten passwords. The challenge response used to unlock the system is common to all users and fixed, allowing a remote attacker to unlock the system after obtaining it.

Authentication bypass vulnerability in Stela versions prior to 1.60.1 due to the use of a cookie named “authProcess” without validating its integrity. The application stores the user identifier (userId) and the status of the authentication process (validSteps) in this cookie and relies on these client-modifiable values to complete the login process.

The User Rights Access Manager WordPress plugin through version 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role created as a copy of the administrator role. This allows unauthenticated attackers to register an administrator-equivalent account.

In the RACK stack, the 16-bit allocation counter is doubled when the PCM sample array needs to grow. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection.

SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. Missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks, makes it possible for unauthenticated attackers to upload files that may be executable, leading to remote code execution.

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including administrators, without requiring a password. The HTTPBasicAuth modules for the agent and customer interfaces read the username not only from $ENV{REMOTE_USER} but also, as a fallback, from $ENV{HTTP_REMOTE_USER}, which is populated directly from an attacker-controllable "Remote-User" request header.

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected.

Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to Magic Link verification, gaining sessions or creating falsely email-verified accounts.

When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that validate that the user is logged in; with the default certificate, an attacker could sign JWT access tokens and bypass login. An attacker could gain administrative access and perform actions like configuring the service or requesting log collection; device credentials and customer data cannot be accessed with this vulnerability.

When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection; device credentials and customer data cannot be accessed with this vulnerability.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobrancas_geracao.php endpoint accepts POST data via extract($_REQUEST) and inserts it directly into an INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data, or delete database tables.

In WeGIA prior to 3.8.6, the unauthenticated cadastro_cobranca.php endpoint accepts POST input via extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can execute arbitrary SQL to read or modify WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data.

In WeGIA prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.

In Stirling-PDF prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account.

A vulnerability was found in D-Link DIR-868L version 2.01b05. It affects the system function in the /htdocs/cgibin file of the HNAP CGI Handler component. Manipulation of the SOAPACTION argument can lead to OS command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

In Dgraph prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacker-controlled id and group values and passes them to Server.RemoveNode, where group 0 can trigger ProposePeerRemoval. A remote unauthenticated attacker who can reach the Zero HTTP port can read topology through /state, allocate identifiers through /assign, access the exposed /moveTablet administrative route, or remove membership through /removeNode, disrupting the Zero control plane and destabilizing Alpha nodes that depend on Zero. The route registration occurs in dgraph/cmd/zero/run.go, and the demonstrated membership-removal path reaches Server.RemoveNode and ProposePeerRemoval.