Baza CVE

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.

Potencjalne wstrzyknięcie poleceń w Active Storage umożliwia niebezpieczne przetwarzanie obrazów.

Wstrzyknięcie SQL w geopandas umożliwia uzyskanie poufnych informacji.

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php.

A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of the component User Management. Performing a manipulation of the argument group_id results in improper authorization. The attack can be…

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has…

Wstrzyknięcie SQL w ChurchCRM umożliwia nieautoryzowany dostęp do danych.

After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices will be unable to rejoin. A manual…

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects  * Metasys: Application and Data Server…

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to…

Brak uwierzytelnienia w punkcie końcowym Interinfo DreamMaker umożliwia zdalny dostęp do funkcji administracyjnych.

Nieograniczony upload niebezpiecznych plików w Interinfo DreamMaker umożliwia zdalne wykonanie poleceń.

Podatność Path Traversal w Runtipi pozwala na zdalne wykonanie kodu przez nadpisanie pliku konfiguracyjnego.

Manipulacja API w Budibase pozwala na eskalację uprawnień i przejęcie kontroli nad organizacją.

Zagrożenie w deephas umożliwia atakującemu modyfikację zachowania obiektów globalnych.

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user…

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated attacker to create or delete administrator accounts. This vulnerability can grant the attacker full administrative control over the product.

Wykonanie kodu zdalnego w AutoGPT pozwala na uruchamianie nieautoryzowanych skryptów.

immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escalate their own permissions by calling the update endpoint, allowing a low-privilege API key to grant itself full administrative access to the system. Version 2.5.0 fixes the issue.

A vulnerability has been found in Bdtask SalesERP up to 20260116. This issue affects some unknown processing of the component Administrative Endpoint. Such manipulation of the argument ci_session leads to improper authorization. The attack may be performed from remote. The exploit has been…

Wstrzyknięcie SQL w CMS Global Interactive Design Media umożliwia wykonanie poleceń systemowych.

Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API…

Obejście uwierzytelnienia w QR Menu Pro umożliwia wykorzystanie zaufanych identyfikatorów.

Wrażliwość na fikcję sesji w QR Menu umożliwia przejęcie sesji użytkownika.

Błąd kontroli dostępu w QR Menu umożliwia nadużycie uwierzytelnienia.