CVE Vulnerability Catalog

A vulnerability in the Telefunken TE24553B45V2DZ Smart TV (Vestel MB181 / Voltron181 / TiVo OS platform) allows an attacker on the same local network to force the embedded browser to send requests to unintended loopback/internal destinations, including 127.0.0.1. The issue affects firmware version V2.78.0.0 and is fixed in V2.85.2.0.

An SQL injection vulnerability exists in postgrex (part of elixir-ecto) from 0.19.3 before 0.22.4 via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter and extend the streamed statement with their own clauses.

An unauthenticated stored XSS vulnerability in SP Page Builder (< 6.7.0) for Joomla allows an attacker to store malicious JavaScript in the site's database via a single HTTP request. When an administrator opens the editor, the script executes automatically.

Dell OpenManage Server Administrator versions prior to 11.1.0.2 contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it, leading to unauthorized access.

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory from version 0.16.0 before 1.5.0. Users of other language implementations are not affected.

Tobit Laboratories AG TeamDavid's Webbox uses a hard-coded cryptographic key vulnerability. Passwords for locally created users in David are stored in various files using only obfuscation, so any user with access to the server's file system or who can extract files can potentially obtain affected users' passwords.

Tobit Laboratories AG TeamDavid's Webbox application has a buffer overflow vulnerability in password change functionality triggered by including "(editini)" in the file path. The application does not verify that the provided path actually refers to an "Archive.ini" file, allowing an attacker to specify a different file with excessive size. An unauthenticated attacker can crash the server, resulting in denial of service.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm) containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed.

Tobit Laboratories AG TeamDavid's Webbox search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse directories. This allows the creation of folders in arbitrary locations, including sensitive directories such as C:\Windows or for different users. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to local file inclusion in the send email, fax, SMS functionality. By specifying an '@@attach' command in the 'scjob' form field, files can be attached and downloaded by an authenticated user. The filter restricting access to the David config folder and user folder can be bypassed using alternate data streams, allowing download of sensitive files like other users' access files with passwords or the server's private key.

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to arbitrary file deletion in the send email, fax, SMS functionality. By specifying an '@@COMMENTFILE' command in the 'scjob' form field, any file on the system can be deleted.

DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable.

Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.

Vulnerability allowing access to unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the device's web interface.

SQL injection vulnerability in /social/ajax.php?action=login in Photo Share Website 1.0. Manipulation of the 'email' argument results in SQL injection, which can be exploited remotely. The exploit has been made public.

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.