CVE Vulnerability Catalog

A vulnerability in BioStar BIOS Update Utility 1.9.7.3 affects the function sub_110BC in BSMEM64_W10.sys (IOCTL Handler component). Manipulation of the PhysicalAddress/Size arguments results in a write-what-where condition. Local access is required, and the exploit has been made public.

A vulnerability in the drogon library (up to version 1.9.13) affects the makeCriteria function in orm_lib/src/Criteria.cc (ORM component). Manipulation of the filter argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user's session.

A vulnerability in the drogon library (up to version 1.9.13) affects the Mapper::orderBy function in Mapper.h (ORM Mapper component). Manipulation of the sort argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. The affected function is sub_1105C in BS_HWMIO64_W10.sys in the IOCTL Handler component, where manipulation of the PhysicalAddress argument leads to a write-what-where condition. The attack requires local access and the exploit is publicly disclosed.

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. The affected file is /send_order.cgi?parameter=loginout in the Cookie Handler component, where manipulation of the session_id argument causes command injection. Remote exploitation is possible and the exploit is publicly available.

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. The vulnerability affects the function sub_1105C in BS_RVSIO64.sys in the IOCTL Handler component, where manipulation of the PhysicalAddress argument results in a write-what-where condition. The attack requires local access and the exploit is now public.

A vulnerability was detected in BioStar VIVID LED DJ 4.0.2411.1500 in the sub_1105C function of BS_LED64.sys (IOCTL Handler). Manipulation of the AssociatedIrp argument leads to a write-what-where condition. Local access is required and the exploit has been publicly disclosed.

A vulnerability was detected in QCMS up to 6.0.6 in the self_Tmp function of Lib/Config/Controllers.php (Content Detail Page). Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was identified in 03-lovepreetSingh MCP up to commit f95d035c5317fad81af9828286631053ccb23546. The issue affects the create_file function in app/api/mcp/route.ts. Manipulating the filePath/content arguments leads to path traversal. The attack can be launched remotely, and the exploit is publicly available. The product does not use versioning, so information about affected and unaffected releases is unavailable.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged SQL injection vulnerability was found. The saveGallery() function passes form data through a hand-rolled parser into Joomla's Input object, then reads it back with ARRAY/STRING filter types, neither of which sanitizes SQL content. Values from category_names[], catOrderIds, and image-ordering fields are concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database, including UNION-based extraction of #__users password hashes.

A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.

A server-side request forgery vulnerability was detected in NonceGeek dim-sum-app in the textSearchV2Handler function of deno/main.tsx in the Deno Backend component. Manipulation of the supabase_url argument leads to server-side request forgery, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used, and the patch is named 8389032e5d52c28c4855c6126ca7d0eae8af346a.

A security flaw was discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402 in an unknown function of /ubus in the routerd component. Manipulation of the passwd_set argument results in improper access controls, and the attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

A SQL injection vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function of /drug_recommender/Admin/edit_user.php. Manipulation of the ID argument leads to SQL injection, and the attack may be launched remotely. The exploit is publicly available and might be used.

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when the chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

A vulnerability was found in DedeCMS up to 5.7.118 in an unknown function of the file plus/mytag_js.php. Manipulation of the argument aid leads to code injection. The attack can be launched remotely and the exploit has been made public.