CVE Vulnerability Catalog

The Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

A vulnerability was detected in GL.iNet devices (A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000) version 4.8.x. The issue affects the file /usr/bin/gl_nas_sys in the NAS Command Service component, allowing OS command injection. The attack can be launched remotely. Upgrading to version 4.9.0 addresses the issue.

A vulnerability was detected in GL.iNet BE9300 and MT6000 devices version 4.8.x. The issue affects the Firewall-management RPC component, where manipulation of dest_port/dest_ip arguments leads to OS command injection. The attack can be initiated remotely. Upgrading to version 4.9.0 resolves the issue.

A vulnerability was detected in multiple GL.iNet devices (including A1300, AX1800, BE9300, MT6000) up to version 4.8.x. The issue affects the Wi-Fi Timer Power-Schedule feature, where manipulation of switch_power/restore_power arguments leads to OS command injection. The attack can be launched remotely.

A vulnerability was detected in multiple GL.iNet devices (including A1300, AX1800, BE9300, MT6000) up to version 4.8.x. The issue affects the ui.update_langs function in the Language Update component, where manipulation of hour/min/week arguments leads to code injection. The attack can be initiated remotely.

A vulnerability was detected in multiple GL.iNet devices (including A1300, AX1800, BE9300, MT6000) up to version 4.8.x. The issue affects the COPY/MOVE function in the WebDAV Service component, leading to authorization bypass. The attack can be launched remotely.

A vulnerability was identified in Planet9 due to incorrect file permissions on an application executable used by the background service. The service runs with SYSTEM privileges, while the executable grants excessive permissions to non-administrative users. An authenticated local user could modify or replace the executable and execute arbitrary code with SYSTEM privileges.

A vulnerability was found in Edimax EW-7478APC 1.04. The issue affects the stainfo function in the file /goform/stainfo, where manipulation of the interface argument leads to command injection. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability was found in Edimax EW-7478APC 1.04. The issue affects the setWAN function in the file /goform/setWAN, where manipulation of pppUserName/pptpUserName/L2TPUserName arguments leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

A security vulnerability was detected in Edimax EW-7478APC 1.04. It impacts the formWlbasic function in /goform/formWlbasic. Manipulating the rootAPmac argument leads to command injection. The attack can be executed remotely and the exploit is public.

Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. The parser does not enforce a default expression depth limit (ExpressionDepthLimit defaults to null/disabled), so an attacker who controls template input can supply a deeply nested template that exhausts thread stack space and raises a StackOverflowException. Because a StackOverflowException cannot be caught in .NET, this causes immediate, unrecoverable termination of the hosting process, resulting in a denial of service.

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process.

Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path not covered by the ExpressionDepthLimit counter added in the fix for GHSA-wgh7-7m3c-fx25. An attacker who can supply untrusted input to Template.Parse can trigger an uncatchable StackOverflowException that immediately terminates the process, even with the default ExpressionDepthLimit enabled.

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as {{ 1..1000000 | array.size }} or a memory-amplification expression such as {{ 'A' * 200000000 }} can force large CPU or memory consumption even when LoopLimit is configured to a very small value, resulting in denial of service.

Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated.

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that fatally terminates the hosting .NET process.

Scriban before 7.2.0 contains a denial of service vulnerability in the array.insert_at function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process in under a second.

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process.