Stack overflow in Wavlink WL-NU516U1 firmware's /cgi-bin/adm.cgi allows remote attackers with high privileges to achieve code execution via a malicious time_zone parameter. Public exploit code exists for this vulnerability, though exploitation requires high complexity and the vendor has not released a patch.
Unauthenticated command injection in the wireless configuration interface of Wavlink WL-WN579A3 firmware allows remote attackers to execute arbitrary commands through the delete_list parameter. Public exploit code is available for this vulnerability, and no patch has been released by the vendor despite early notification. Affected devices can be compromised remotely to gain full system access with minimal authentication requirements.
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the IP parameter. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the MACHINES parameter. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the ipblock.cgi endpoint. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the xtaccess.cgi endpoint. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the NTP_SERVER parameter. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dmzholes.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by manipulating the MACHINE and MACHINECOMMENT parameters. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the portfw.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the apcupsd.cgi script that allow attackers to inject malicious scripts through multiple POST parameters. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script that allow attackers to inject malicious scripts through unvalidated parameters. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the dhcp.cgi script that allow attackers to inject malicious scripts through multiple parameters. [CVSS 6.1 MEDIUM]
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple cross-site scripting vulnerabilities in the proxy.cgi endpoint that allow attackers to inject malicious scripts through parameters including CACHE_SIZE, MAX_SIZE, MIN_SIZE, MAX_OUTGOING_SIZE, and MAX_INCOMING_SIZE. [CVSS 6.1 MEDIUM]
Path traversal in ZenTao's editor component (versions up to 21.7.8) allows authenticated attackers to manipulate the filePath parameter and access files outside intended directories. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems vulnerable to unauthorized file access and potential information disclosure.
Smoothwall Express 3.1-SP4-polar-x86_64-update9 contains multiple reflected cross-site scripting vulnerabilities in the interfaces.cgi script that allow attackers to inject malicious scripts through multiple parameters including GREEN_ADDRESS, GREEN_NETMASK, RED_DHCP_HOSTNAME, RED_ADDRESS, DNS1_OVERRIDE, DNS2_OVERRIDE, RED_MAC, RED_NETMASK, DEFAULT_GATEWAY, DNS1, and DNS2. [CVSS 5.4 MEDIUM]
Memory corruption in Open5GS up to version 2.7.6 allows remote attackers to cause denial of service through manipulation of the MME component's esm-build.c file. Public exploit code exists for this vulnerability, and the Open5GS project has not yet released a patch despite early notification.
Open5GS versions up to 2.7.6 are vulnerable to a denial of service condition in the SMF component's PDP context request handler, which can be triggered remotely without authentication. An attacker can exploit this reachable assertion flaw to crash the service, and public exploit code is currently available. No patch has been released by the project despite early notification of the issue.
Free5GC versions up to 4.1.0 are vulnerable to denial of service attacks targeting the PFCP UDP Endpoint component, which can be exploited remotely without authentication. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected deployments at risk of service disruption.
Open5GS 2.7.6 is vulnerable to denial of service through improper handling of S11 session response messages in the MME component, allowing remote unauthenticated attackers to crash the service. Public exploit code exists for this vulnerability, and the vendor has not yet provided a patch despite early notification.
JeecgBoot 3.9.1's RAG knowledge controller fails to properly validate ZIP file imports, allowing authenticated remote attackers to trigger unsafe deserialization with public exploit code available. The vulnerability requires authentication and complex attack execution but could enable information disclosure or integrity compromise. No patch is currently available from the vendor.
An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page. [CVSS 4.3 MEDIUM]
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive system data including database credentials and API keys through specially crafted placeholder syntax that bypasses existing security controls. An attacker with email template modification privileges can leverage Python object introspection to access arbitrary system configuration details. No patch is currently available for this vulnerability affecting Pretix and its Double Opt In Step extension.
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive system data including database credentials and API keys through specially crafted placeholder syntax that bypasses existing validation controls. An attacker with email template editing permissions can leverage this vulnerability to access confidential configuration information from the system. A patch is available to address the ineffective placeholder sanitization mechanism.
Server-side request forgery in Deepaudit versions up to 3.0.3 allows authenticated remote attackers to manipulate the IP Address Handler component in the embedding configuration endpoint, potentially enabling them to perform arbitrary network requests from the affected server. The vulnerability requires valid credentials but no user interaction, affecting the AI/ML product's backend services. Upgrading to version 3.0.4 or later resolves this issue.
Cross-Site Scripting (XSS) vulnerability reflected in Kubysoft, which occurs through multiple parameters within the endpoint ‘/node/kudaby/nodeFN/procedure’. [CVSS 6.1 MEDIUM]
Tosei Self-service Washing Machine 4.02 contains an unauthenticated command injection vulnerability in the adr_txt_1 parameter of /cgi-bin/tosei_datasend.php, allowing remote attackers to execute arbitrary commands with limited confidentiality, integrity, and availability impact. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
Pretix email template placeholder injection enables authenticated backend users to extract sensitive system information such as database credentials and API keys through specially crafted placeholder syntax that bypasses insufficient input validation. An attacker with backend access can leverage this vulnerability to enumerate system configuration details and potentially compromise infrastructure security. No patch is currently available for this medium-severity issue affecting Pretix installations.
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allows authenticated users to exfiltrate password hashes and MFA secrets via profile nickname updates or email verification events. [CVSS 5.7 MEDIUM]
Improper access controls in LibrarySystem BookController.java (versions up to 1.1.1) allow unauthenticated remote attackers to gain unauthorized access and potentially modify or disable library system functions. Public exploit code exists for this vulnerability and the vendor has not yet provided a patch despite early notification.
Mattermost Server versions 11.1.x through 11.1.2, 10.11.x through 10.11.9, and 11.2.x through 11.2.1 inadequately enforce login method restrictions, permitting authenticated users to circumvent SSO-only requirements by authenticating with a userID instead. This allows an attacker with valid credentials to gain unauthorized access to accounts restricted to single sign-on authentication. No patch is currently available for this vulnerability.
Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, which is triggered through multiple parameters in the '/kForms/app' endpoint. This issue allows malicious scripts to be injected and executed persistently in the context of users accessing the affected resource. [CVSS 5.4 MEDIUM]
Stored Cross-Site Scripting (XSS) vulnerability in Kubysoft, where uploaded SVG images are not properly sanitized. [CVSS 5.4 MEDIUM]
Insufficient identity validation in Mattermost Server (versions 11.1.x through 11.2.1 and earlier) and Zoom Plugin (versions up to 1.11.0) allows authenticated users to initiate Zoom meetings as arbitrary users and modify other users' posts through direct API manipulation. An attacker with valid credentials can exploit the /api/v1/askPMI endpoint to impersonate other users and alter post content without proper authorization checks. The vulnerability affects multiple Mattermost and plugin versions with no patch currently available.
Mattermost and Zoom plugin versions fail to properly authenticate users before allowing modifications to Zoom meeting restrictions, enabling any logged-in user to alter meeting settings across arbitrary channels. Affected versions include Mattermost 11.1.x through 11.1.2, 10.11.x through 10.11.9, 11.2.x through 11.2.1, and Zoom plugin versions up to 1.11.0. No patch is currently available for this privilege escalation vulnerability.
Firefox for iOS before version 147.2.1 fails to properly synchronize the address bar with page content when malicious scripts interfere with new tab loading, enabling attackers to conduct HTML spoofing attacks under trusted domains. An attacker can exploit this through a malicious webpage to deceive users into believing they are viewing legitimate content from a trusted site. This vulnerability requires user interaction to trigger but has no patch currently available.
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate team membership when processing channel mentions which allows authenticated users to determine the existence of teams and their URL names via posting channel shortlinks and observing the channel_mentions property in the API response. [CVSS 4.3 MEDIUM]
Insufficient capability checks in RegistrationMagic WordPress plugin versions before 6.0.7.2 allow subscriber-level users and above to create forms, enabling unauthorized form creation and potential site manipulation. This vulnerability affects WordPress sites running the affected plugin versions, with no patch currently available. The impact is limited to form creation without affecting confidentiality or system availability.
from 4.30 versions up to 16022026. is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).