CVE Vulnerability Catalog

A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

In the adafap api-mcp project (up to version 92b9a5d04acfec165c7d4ef852496593aa87be06), a vulnerability was found in the customAxios function of app/api/proxy/route.ts (Proxy API Endpoint component). Manipulation of the url argument leads to server-side request forgery (SSRF). The attack can be carried out remotely.

A vulnerability was identified in MingSoft MCMS up to version 3.0.6, affecting the ModelDataImpl.queryDiyFormData function in the file /mdiy/form/data/list.do of the ms-mdiy component. Manipulating the formFields argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in node-sql-query versions 0.1.25 through 0.1.28, affecting the SelectQuery.from and SelectQuery.build functions in lib/Select.js. The attack can be initiated remotely. The issue is fixed in version 0.1.29.

A vulnerability in Tenda CH22 1.0.0.1 allows command injection in the formCertListInfo function of /goform/CertListInfo. Manipulating the Name argument enables remote command execution. The exploit is public.

A SQL injection vulnerability exists in code-projects Task Management System 1.0 in /user/comment_count_user.php. Manipulating the task_id argument allows remote SQL queries. The exploit is public.

A SQL injection vulnerability exists in code-projects Task Management System 1.0 in /admin/AdminLogin.php. Manipulating email/password arguments allows remote SQL queries. The exploit is public.

A vulnerability in code-projects Task Management System 1.0 in the Login component of /index.php allows improper authentication via manipulation of the Password argument. The attack can be performed remotely. The exploit is public.

A stack-based buffer overflow vulnerability exists in UTT HiPER 1200GW up to 2.5.3-170306 in the strcpy function of /goform/pptpSrvGlobalConfig. Manipulating the EncryptionMode argument allows remote code execution. The exploit is public, and the vendor did not respond.

The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.

The WP Data Access WordPress plugin before version 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.

The Iptanus File Upload WordPress plugin before version 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.

The CubeWP Framework WordPress plugin before version 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.

The GeoDirectory WordPress plugin before version 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, in the SPA catch-all route in `backend/routers/ui.py`. Improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization, allows an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3.

In the Crypt::OpenSSL::PKCS12 library for Perl before version 1.98, there is a NULL pointer dereference vulnerability in the print_attribute function when handling a zero-length BMPSTRING attribute. The zero length causes the buffer to be freed and return NULL, and a subsequent strlen call on that pointer crashes the process.

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.