CVE Vulnerability Catalog

W podatności CVE-2025-58951 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniu SQL, co prowadzi do możliwości wstrzyknięcia SQL w systemie zarządzania rezerwacjami miejsc smartcms Advance dla WooCommerce. Problem ten dotyczy wersji od n/a do 3.1 włącznie.

Podatność CVE-2025-54723 dotyczy deserializacji niezaufanych danych w wtyczce BoldThemes DentiCare, co umożliwia wstrzyknięcie obiektów. Problem ten dotyczy wersji DentiCare od n/a do poniżej 1.4.3.

W podatności CVE-2025-53433 występuje niewłaściwe zarządzanie nazwą pliku w instrukcji Include/Require w programie PHP, co prowadzi do lokalnego włączenia pliku PHP. Problem dotyczy wersji EasyEat od n/a do 1.9.0 włącznie.

Memory corruption vulnerability occurs when a corrupted ELF image with an oversized file size is read into a buffer without authentication.

Zerobyte to narzędzie do automatyzacji kopii zapasowych, które w wersjach przed 0.18.5 i 0.19.0 zawiera podatność na obejście uwierzytelniania. Problem polega na tym, że middleware uwierzytelniające nie jest prawidłowo stosowane do punktów końcowych API, co umożliwia dostęp do nich bez ważnych poświadczeń sesji.

W wersjach mcp-server-git przed 2025.12.17, serwer uruchamiany z flagą --repository nie weryfikował, czy argumenty repo_path w kolejnych wywołaniach narzędzi mieszczą się w skonfigurowanej ścieżce. To mogło pozwolić na operacje na innych repozytoriach dostępnych dla procesu serwera.

PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information.

UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

SitemagicCMS 4.4.3 contains a remote code execution vulnerability that allows attackers to upload malicious PHP files to the files/images directory. Attackers can upload a .phar file with system command execution payload to compromise the web application and execute arbitrary system commands.

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.

FreeRDP before version 3.20.0 contains a vulnerability in certificate handling on Windows platforms. The function freerdp_certificate_data_hash_uses uses the Microsoft-specific _snprintf to format certificate cache filenames without guaranteeing NUL termination, which when an attacker controls the hostname can lead to a heap-based out-of-bounds read.

ChurchCRM before version 6.5.3 contains a SQL injection vulnerability in the Event Attendee Editor. An authenticated user can execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. Attackers can extract sensitive member data, credentials, and financial information. Version 6.5.3 includes a patch.

ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.

ChurchCRM before version 6.5.3 in the Database Restore functionality does not validate the content or file extension of uploaded files. An attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access. Once accessed, the web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

In DriveLock versions 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*, an incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).

In DriveLock versions 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6, users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.

In RIOT OS v2025.07, a vulnerability was discovered in the IPv6 fragmentation reassembly implementation. When copying the contents of the first fragment (offset=0) into the reassembly buffer, no size check is performed. It is possible to force the creation of a small reassembly buffer by first sending a shorter fragment (also with offset=0). Overflowing the reassembly buffer corrupts the state of other packet buffers which an attacker might be able to use to achieve further memory corruption (potentially resulting in remote code execution). To trigger the vulnerability, the `gnrc_ipv6_ext_frag` module must be included and the attacker must be able to send arbitrary IPv6 packets to the victim. Version 2025.10 fixes the issue.

Problem dotyczy niewłaściwej walidacji adresów URL w Safari, co może pozwolić na wykorzystanie interfejsów API Web w kontekście, który powinien być ograniczony. Został naprawiony w wersji Safari 26.2 oraz macOS Tahoe 26.2.

Problem z konfiguracją został rozwiązany poprzez wprowadzenie dodatkowych ograniczeń. Problem ten został naprawiony w iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2 oraz visionOS 26.2, gdzie zdjęcia w albumie Ukryte mogą być przeglądane bez uwierzytelnienia.