CVE Vulnerability Catalog

compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. The issue affects the save_doctor function in /save_file.php, allowing unrestricted file upload. The attack can be executed remotely, and the exploit is publicly available.

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. The issue affects unknown code in /admin/reporting/sales/ of the Backend Reporting Endpoint, leading to authorization bypass. Remote exploitation is possible, and the exploit is publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit this, leading to information disclosure.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to privilege escalation.

A CWE-22 Path Traversal vulnerability was identified in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad version 0.11.0. A local unauthenticated attacker can delete arbitrary files with the privileges of the RevPiPyLoad daemon, leading to loss of configuration integrity and denial of service.

A CWE-22 Path Traversal vulnerability was identified in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad version 0.11.0. A local unauthenticated attacker can read arbitrary files with the privileges of the RevPiPyLoad daemon, including sensitive configuration and credential material.

A CWE-352 Cross-Site Request Forgery (CSRF) vulnerability was identified in the web-based configuration backend of KUNBUS PiCtory version 2.16.0. A remote unauthenticated attacker can perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim's browser to submit crafted requests.

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. The issue affects unknown functionality in /admin/customers/view of the Backend Customer Detail Feature. Manipulation of the ID argument results in authorization bypass. The attack may be initiated remotely, and the exploit is publicly available. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A vulnerability was determined in Webkul Bagisto up to 2.4.4. The issue affects an unknown function in /admin/customers/login-as-customer/ of the Admin Customer Impersonation Feature. Manipulation of the ID argument causes authorization bypass. The attack can be initiated remotely, and the exploit has been publicly disclosed. The vendor confirms that some issues are already addressed, while others are planned for future releases.

A race condition vulnerability in the event notification functionality of KUNBUS piControl version 2.6.2. A local authenticated attacker can corrupt kernel heap and event-list state and disclose a small amount of adjacent kernel memory by issuing concurrent crafted requests from multiple threads through the piControl character device.

A flaw in Samba's CTDB, the clustered database service, involves insufficient integrity validation of received CTDB protocol packets. A remote attacker with access to the CTDB private network can trigger denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.

A path-traversal vulnerability in the logback-classic module (Java) by QOS.CH Sarl. An MDC-based discriminator value flows unsanitized into a nested FileAppender path, allowing an attacker who influences that MDC value (e.g., via an HTTP header) to create and append log files outside the intended directory. Affects versions from 0.9.14 through 1.6.2.

A flaw in Undertow, an HTTP server, in its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers, leading to truncation into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

A flaw in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.

An authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows exploitation of trusted identifiers. Affects versions from 20251127 before 20260204.

A vulnerability in TRENDnet TEW-816DRM (version GURNC4.OT182B-C-TN-R1B028-US.EN) affects an unknown function in the file /etc/bftpd.conf of the bftpd component. Manipulation of the argument USERLIMIT_GLOBAL results in allocation of resources. The attack can be launched remotely. This vulnerability only affects products that are no longer supported by the maintainer.

A security flaw in wvp-GB28181-pro version 2.7.4-20260107 affects unknown code in the file LogController.java of the Log File Download Endpoint. Manipulation of the argument fileName results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability in wvp-GB28181-pro version 2.7.4-20260107 affects an unknown part of the file PlayController.java of the Snapshot Endpoint. Manipulation of the arguments deviceId/channelId leads to path traversal. The attack can be initiated remotely. The exploit is publicly available and might be used.