CVE Vulnerability Catalog

A heap-based buffer overflow exists in the boa formUpload() functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

An OS command injection vulnerability exists in the batchupg functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can trigger this vulnerability with an authenticated HTTP request.

The parser in the PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid.

When CURLOPT_INTERFACE (or --interface) is set with one of the documented prefixes (if!, host!, ifhost!), that binding is not part of the connection reuse key. A later transfer asking for a different source can silently reuse an existing connection and go out from the earlier transfer's source address.

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out-of-bounds read when gnutls_record_send() returns a number of bytes sent greater than the number of bytes it was given to send, which GnuTLS does after a blocked send.

PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length.

The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination.

The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. This may lead to an out-of-bounds write.

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter in GET requests to /scripts/logdownload.php.

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter in GET requests to /admin/import-export/download-content.php.

JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted values in the graph parameter of /monitoring?part=graph. Attackers can include a closing script tag in the graph value, which is only JavaScript-escaped in HtmlCounterReport, to execute script in victims' browsers.

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter in GET requests to menu/documento/requests/ajax-docs.php.

Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter in GET requests.

FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter in GET requests to /user/City_ajax.aspx.

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile() in aspose_pdf_exporter_download.php.

Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter in aspose_import_export_download.php.

The Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials.