CVE Vulnerability Catalog

WeGIA versions 3.4.12 and below include an SQL Injection vulnerability in the /controle/control.php endpoint, specifically in the descricao parameter, allowing attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.

The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.

The Flock Safety Android Collins application (com.flocksafety.android.collins) 6.35.31 for Android lacks authentication and exposes administrative API endpoints on port 8080 without authentication. Endpoints include /reboot, /logs, /crashpack, and /adb/enable, leading to denial of service (DoS), information disclosure, and remote code execution (RCE). Specifically, /adb/enable starts adb over TCP without debugging confirmation, giving an attacker in the LAN/WLAN shell access.

AndSoft e-TMS v25.03 is vulnerable to SQL injection in /inc/connect/CONNECTION.ASP via the 'SessionID' cookie. An attacker can send a POST request to retrieve, create, update, and delete database data.

SQL injection vulnerability in AndSoft's e-TMS v25.03. It exists in the 'USRMAIL' parameter in '/inc/login/TRACK_REQUESTFRMSQL.ASP' and allows an attacker to retrieve, create, update, and delete databases by sending a POST request.

An operating system command injection vulnerability exists in AndSoft's e-TMS v25.03.03. An attacker can execute arbitrary OS commands on the server by sending a crafted POST request with the 'm' parameter to '/CLT/LOGINERRORFRM.ASP'.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_CAT.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_original.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_BET.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_LXA.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM_DJO.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

AndSoft e-TMS v25.03 is vulnerable to operating system command injection via the 'm' parameter in /clt/LOGINFRM.ASP. An attacker can send a POST request to execute arbitrary commands on the server.

OpenSIAC has an incorrect authentication vulnerability that could allow an attacker to impersonate a person using Cl@ve as an authentication method.

Wtyczka Ajax WooSearch dla WordPressa w wersji do 1.0.0 nieprawidłowo sanitizuje i nie ucieka parametru przed użyciem go w zapytaniu SQL za pośrednictwem akcji AJAX dostępnej dla nieautoryzowanych użytkowników, co prowadzi do podatności na atak SQL injection.

RISC Zero versions 2.0.2 and below of risc0-zkvm-platform allow the host to use a crafted response to the guest's sys_read call to write to an arbitrary memory location in the guest. This can lead to arbitrary code execution within the guest and critically compromises the soundness guarantees of the guest program. Fixes are in risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3.

Termix versions 1.5.0 and below, when using the official Docker image or an Nginx reverse proxy, incorrectly identifies the client IP as the proxy IP, causing isLocalhost to always return True. This makes the /ssh/db/host/internal endpoint accessible without login or authentication, exposing stored SSH host information including addresses, usernames, and passwords.

In ExtremeGuest Essentials before 25.5.0, the captive-portal may permit unauthorized access via a manual brute-force procedure. Under certain captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access, and Client360 logs may show the client MAC as the username despite MAC-authentication being disabled.

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function. The vulnerability allows execution of arbitrary commands.

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function. The vulnerability allows execution of arbitrary commands.

In the Linux kernel TIPC module, during link MTU negotiation, a malicious peer can send an Activate message with a very small MTU (e.g., 4). Without checking the minimum MTU, this value is set as the link MTU, leading to an integer overflow when calculating message size and potentially causing a system crash.