Baza CVE

A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup controller. The parameter is…

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user…

Nieautoryzowana usługa .NET Remoting w Calero VeraSMART pozwala na zdalne wykonanie kodu.

Statyczne wartości machineKey w Calero VeraSMART umożliwiają zdalne wykonanie kodu.

Błąd w BACnet Stack umożliwia zdalne wywołanie awarii systemu przez złośliwe żądanie.

A zip slip vulnerability in the /DesignTools/SkinList.aspx endpoint of MojoPortal CMS v2.9.0.1 allows attackers to execute arbitrary commands via uploading a crafted zip file.

Ucieczka z piaskownicy w Cursor umożliwia zdalne wykonanie kodu przez niechronione ustawienia .git.

Wykorzystanie podatności w Hyland OnBase umożliwia zdalne wykonanie kodu przez nieautoryzowany dostęp.

Błąd w funkcji nvmet_tcp_build_pdu_iovec w jądrze Linuxa może prowadzić do naruszenia pamięci, co skutkuje awarią systemu.

FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload that triggers a buffer overflow when pasted into the Custom Command textbox, enabling…

Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can access the device by using the hard-coded username 'admin' and password 'admin' in the hidden form input fields.

Wstrzyknięcie złośliwego URL w Yoke pozwala na wykonanie dowolnego kodu WASM i eskalację uprawnień.

Airleader Master versions 6.381 and prior allow for file uploads without restriction to multiple webpages running maximum privileges. This could allow an unauthenticated user to potentially obtain remote code execution on the server.

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure Matrix server key generation method,…

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory. Attackers can replace the original MobileGo.exe with a malicious executable to create a new user account and add it to the Administrators…

Brak weryfikacji nazw hostów w Galaxy FDS SDK umożliwia atak man-in-the-middle.

Wykonanie zdalnego kodu w Crawl4AI umożliwia atakującym pełne przejęcie serwera.

Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who indicates that exploitation can only occur if an unprivileged user knows the token of an admin user.

Nieograniczony upload niebezpiecznych plików w Smart Panel umożliwia dostęp do nieautoryzowanej funkcjonalności.

Wstrzyknięcie SQL w pakiecie E-Commerce Farktor umożliwia przeprowadzenie ataku typu Blind SQL Injection.

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com, TCP 8883). This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to…

The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.

Manipulacja nagłówkiem żądania w JUNG Smart Visu Server pozwala na przejęcie kontroli nad URL-ami.

W JUNG Smart Visu Server występuje podatność na DoS, umożliwiająca zdalne wyłączenie serwera.

The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for…