CVE Vulnerability Catalog

Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leads to unauthenticated root login with a blank password on X5000R V9.1.0u.6369_B20230113, allowing arbitrary command execution. Earlier versions sharing the same implementation may also be affected.

Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method. Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data received, allowing an attacker with access to the local machine or internal network to impersonate the legitimate WebSocket and inject manipulated information.

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers, leading to full device compromise.

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

The Access Point functionality in EZCast Pro II before version 1.17478.177 has a predictable default Wi-Fi password, allowing attackers within Wi-Fi range to gain access to the device by calculating the default password from observable device identifiers.

In EZCast Pro II versions before 1.17478.177, hard-coded cryptographic keys in the admin UI allow attackers to bypass authorization checks and gain full access to the admin UI.

Wtyczka Elated Membership dla WordPressa jest podatna na obejście uwierzytelniania we wszystkich wersjach do i włącznie z 1.2. Problem wynika z niewłaściwego logowania użytkownika z danymi wcześniej zweryfikowanymi przez funkcje 'eltdf_membership_check_facebook_user' oraz 'eltdf_membership_login_user_from_social_network'.

PipesHub to platforma AI do automatyzacji pracy, która w wersjach przed 0.1.0-beta ma lukę w zabezpieczeniach. Brak autoryzacji na końcówce POST /api/v1/record/buffer/convert pozwala atakującemu na przesyłanie plików i nadpisywanie ich w dowolnej lokalizacji, co może prowadzić do złośliwego działania.

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute malicious code. Exploitation of this issue does not require user interaction and scope is changed.

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction and scope is unchanged.

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high privileged attacker. Exploitation of this issue does not require user interaction and scope is changed.

ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted instances. This allows an unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls. This issue is fixed in version 4.7.1.

Moduł Endpoint Manager w systemach FreePBX jest podatny na obejście uwierzytelnienia, gdy typ uwierzytelnienia jest ustawiony na 'webserver'. Umożliwia to powiązanie sesji z docelowym użytkownikiem przy użyciu nagłówka Authorization z dowolną wartością, niezależnie od poprawnych poświadczeń.

Wtyczka @vitejs/plugin-rs, która obsługuje komponenty serwerowe React (RSC) dla Vite, w wersjach 0.5.5 i poniżej jest podatna na zdalne wykonanie dowolnego kodu na serwerze deweloperskim. Problem wynika z niebezpiecznych dynamicznych importów w API funkcji serwerowych, co może prowadzić do ujawnienia wrażliwych danych.

MiniDVBLinux 5.4 contains a remote code execution vulnerability in the SVDRP protocol that allows remote attackers to send commands to manipulate TV systems. Attackers can send crafted SVDRP commands through the svdrpsend.sh script to execute messages and potentially control the video disk recorder remotely.

MiniDVBLinux 5.4 contains an authentication bypass vulnerability that allows remote attackers to change the root password without authentication. Attackers can send crafted POST requests to the system setup endpoint with modified SYSTEM_PASSWORD parameters to reset root credentials.

Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configuration backup files containing sensitive credentials. Attackers can retrieve the lk3_settings.bin file and extract base64-encoded user and admin passwords without authentication.

Kamera Selea Targa IP OCR-ANPR zawiera podatność na twardo zakodowane hasło dewelopera, co umożliwia nieautoryzowany dostęp do konfiguracji przez nieudokumentowaną stronę. Atakujący mogą wykorzystać ukryty punkt końcowy, używając zakodowanego hasła 'Selea781830', aby włączyć przesyłanie konfiguracji i nadpisać ustawienia urządzenia.

Kamera Selea Targa IP OCR-ANPR zawiera podatność na nieautoryzowaną iniekcję poleceń w pliku utils.php, co pozwala zdalnym atakującym na wykonywanie dowolnych poleceń powłoki. Atakujący mogą wykorzystać parametry 'addr' i 'port' do wstrzykiwania poleceń oraz uzyskania dostępu do użytkownika www-data poprzez techniki łańcuchowej lokalnej inkluzji plików.

COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Attackers can exploit this by sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.