CVE Vulnerability Catalog

Stored Cross-Site Scripting (XSS) vulnerability in TaskRunHandler.post() in web/handlers/task.py in QD. When a task is run via /task/<taskid>/run, task log content is rendered into the HTML response without HTML encoding, allowing a low-privileged attacker to inject malicious script.

An OS command injection vulnerability was found in Edimax BR-6214K 1.40 in the system function of www/ping.asp (asp_setPing Endpoint). Manipulating the pingstr argument allows remote command execution. The exploit is public and the vendor did not respond.

A vulnerability was identified in Edimax BR-6214K 1.40 in the system function of www/wlanMP.asp. Manipulation of the ateFunc argument leads to OS command injection, allowing remote attacks. The exploit is publicly available.

Incorrect access control in the setLanCfg function of TOTOLINK T6 allows unauthenticated attackers to alter LAN network configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

A cross-site scripting (XSS) vulnerability was found in code-projects Online Shopping System 1.0 in /offersmail.php. Manipulation of the email argument allows remote script execution in the victim's browser. The exploit is public.

A use of default password vulnerability was found in sambitraj Student-Management-System up to commit 56ba287f. Remote exploitation is possible and the exploit is public. The project has not responded.

An Open Redirect vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) via the Base64 return parameter. Redirect parameters accept arbitrary Base64 strings without verifying if the target is an internal URL.

A missing authorization vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) in MegaMenu settings. The AJAX endpoint save-megamenu-settings fails to enforce item-level and menu-level edit permissions. An authenticated user can modify layout parameters for arbitrary menu items without proper authorization.

A broken object-level authorization vulnerability was found in Helix Ultimate for Joomla (versions < 2.2.10) in blog image deletion. Blog::remove_image() checks if the user is authorized to edit the article, but does not verify if the image path belongs to that article. On Joomla 3 builds, an author can delete arbitrary files under /images/.

A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractSingleSelectChoice (base class of DropDownChoice). The default option body is written without escaping, while other options are escaped. Applications overriding getNullValidDisplayValue() or getNullKeyDisplayValue() with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.

A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractOptions (renders option lists in Palette). Attribute names and values from getAdditionalAttributes are written without escaping. Applications overriding getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or getAdditionalAttributes with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to alter logging configuration via a crafted POST request to /cgi-bin/cstecgi.cgi.

A SQL injection vulnerability was found in itsourcecode Sales and Inventory System 1.0 in /pages/inv_searchfrm.php. Manipulation of the ID argument allows remote SQL queries. The exploit is public.

A missing authorization vulnerability was found in bbPress (versions up to 2.6.14), allowing exploitation of incorrectly configured access control security levels. This can be used for unauthorized actions.

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the setWizardCfg function of TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to reconfigure WAN, Wi-Fi, and device initialization state via a crafted POST request to /cgi-bin/cstecgi.cgi.

Uncontrolled recursion in Samsung Open Source rlottie allows processing of serialized data with nested payloads, potentially leading to system overload or denial of service. Affects versions before 8de0d9e6ca80ffef654965505981727b9fa06a51.

In Apache Wicket, the MetaDataHeaderItem component improperly neutralizes input during web page generation. Attribute values in <meta> and <link> tags are not properly escaped, allowing injection of additional attributes. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.

In Apache Wicket, the <wicket:label> tag is rendered without escaping, allowing HTML injection if the label comes from a model containing attacker-controlled data. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.

XSS vulnerability in Apache Wicket affects the Button component rendered as a <button> element. The constructor clears the escape-model-strings flag, so the model is not encoded when written to the element body, allowing markup injection.