CVEs

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface. The WebFig session token (s2d) is a bearer credential not bound to the ECDH session that generated it, with no rotation on reuse and no client-side revocation. The makeSessionKey function in libucrypto.so mints tokens from fixed salts with no channel or session-specific input, and the user service validates them against the login store without verifying channel context, so a token captured through the CVE-2025-61481 cleartext MITM path or a SPA XSS can be replayed from a completely fresh ECDH session, with new keys and no password, and the server still accepts it as admin and reissues it. This grants persistent, transport-independent administrative access until the token store is explicitly cleared. 7.24.3 reworked only the channel crypto and left the token binding untouched.

Xorbits xoscar, the actor/RPC framework underlying Xinference, contains an unauthenticated deserialization vulnerability in its socket transport. SocketChannel.recv() reads a header and buffers straight off the TCP socket and passes them to deserialize(), which calls cloudpickle.loads() on the attacker-controlled buffer before the actor pool validates the message, with no authentication anywhere in the path. Any host that can reach the actor pool port can send a pickle __reduce__ gadget and achieve remote code execution as the server process. All versions through 0.11.2 are affected with no fixed release.

The odt2spip plugin for SPIP before 4.4.0 contains an authenticated OS command injection vulnerability in its document import form. The filename of an uploaded non-.odt document is taken from the request and survives insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), so an authenticated author embedding shell metacharacters such as $(id) in the filename achieves remote code execution as the web-server user during the LibreOffice conversion.

The JCTables extension for Joomla by joomcode.com before 1.21.1 contains an unauthenticated SQL injection in its front-end CRUD API. The controller performs no Joomla token validation and no authentication check on any task, and table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing arbitrary read and write SQL injection that can be chained to remote code execution.

Softaculous Virtualizor before 3.2.9 patch 9 (also fixed in 3.3.0) contains an unauthenticated OS command injection vulnerability in the admin panel's billing-module hook. The pre-authentication guard only redirects requests whose act parameter is not login, so act=login falls through to the from_billing_module handler, which unserializes the billing_data POST field and concatenates its uid into a shell command executed by the root-owned admin php-fpm pool, giving remote code execution as root.

Softaculous Virtualizor before 3.2.9 patch 9 (also fixed in 3.3.0) contains a PHP object injection vulnerability in the same unauthenticated billing-module handler, which passes the attacker-controlled billing_data POST field to a native unserialize() call with no allowed_classes restriction, deserializing untrusted data inside the root process.

Softaculous Virtualizor before 3.2.9 patch 9 (also fixed in 3.3.0) contains a cross-tenant account balance modification vulnerability in the unauthenticated billing-module handler, whose whmcs branch writes the cur_bal column for an attacker-chosen uid with no authentication or ownership check, letting an anonymous request set any tenant's balance.

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names, reaching the ImageMagick montage command construction.

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input from a superuser-reachable settings test endpoint to reach an exec() sink unsanitized.

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing getValuesString() in DB/DP.php to interpolate raw array values into an INSERT statement without parameterization. Emulated prepared statements enable stacked queries, letting attackers manipulate the permissions table to escalate a delegated administrator to superuser.

FileRun before 2026.3.0 contains a PHP object injection vulnerability caused by incorrect options passed to unserialize() in Perms::getPerms(), where a positional array is used instead of the named-key array required to disable class instantiation. Attackers with database write access can inject a serialized gadget chain into permissions columns processed on every authenticated page load to write arbitrary files, such as PHP webshells, to web-accessible paths.

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

FileRun through 2026.2.0 contains an authenticated OS command injection vulnerability in the thumbnail generation functionality. The exec() calls for ffmpeg and ImageMagick pass user-controlled filenames without escapeshellarg() sanitization, allowing authenticated attackers to execute arbitrary system commands via crafted file names.

Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation flaw in ReceivedPacketCache::enqueuePacket(). An attacker can send a crafted UDP packet with mUniquePacketID set to its maximum value, causing the server to allocate excessive memory for missing packet IDs until system resources are exhausted, triggering an uncaught exception that crashes the process.

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation flaw in ConnectionManager. Established connections rely solely on a two-byte local connection handle for identification without confirming the datagram source address matches the registered remote address. An on-path attacker can inject malicious packets into active sessions by forging the connection identifier, enabling session termination, arbitrary channel message forgery, and fabricated request responses without IP spoofing.

Aimy Captcha-Less Form Guard 18.0 through 20.0 for Joomla contains an unauthenticated PHP object injection vulnerability in the onCheckAnswer() captcha validation handler. The plugin protects forms with a hidden clfgd field whose value is a PHP-serialized object obfuscated with repeating-key XOR and passed directly to unserialize(). Since the plugin renders a valid clfgd ciphertext in the form HTML alongside all inputs needed to reconstruct the plaintext, an attacker recovers the XOR keystream and forges arbitrary serialized objects. On Joomla 3.9 through 5.2.1, chaining with the native FormattedtextLogger POP gadget drops a PHP file into the webroot, achieving unauthenticated remote code execution.

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obtain a CSRF token from the public getSystemVars endpoint and submit a fetchRemoteFile request with a source URL resolving to an IPv4-mapped address, causing the server to issue HTTP requests to internal services and write responses to an attacker-controlled FTP destination, enabling retrieval of cloud instance metadata credentials.

FOSSBilling 0.1.0 through 0.7.2 contains a Server-Side Template Injection vulnerability in its unsandboxed Twig template rendering. Injected expressions reach the application's dependency injection container via getDi(), exposing services such as PDO for arbitrary database access and escalating to remote code execution.

NVIDIA Spatial Intelligence Lab (SIL) GEN3C before commit db2ffe1 contains an unauthenticated remote code execution vulnerability in its inference API server. The /request-inference and /seed-model endpoints deserialize raw HTTP request bodies via Python's pickle.loads() without authentication or input validation, allowing a crafted __reduce__ gadget to execute arbitrary code as the inference process.

NetBox before the upcoming patch contains a Jinja2 sandbox bypass leading to remote code execution. The RenderTemplateMixin resolves environment_params['finalize'] via import_string() with no allowlist, letting an authenticated low-privilege user pass subprocess.getoutput (or any callable) and execute arbitrary commands when an ExportTemplate or ConfigTemplate is rendered.

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into config.php.

ktransformers balance_serve backend deserializes attacker-controlled data with pickle.loads() in ZMQ worker threads via a ROUTER/DEALER proxy bound to all interfaces. Unauthenticated RCE with network access.

HuggingFace LeRobot contains an unsafe deserialization vulnerability where pickle.loads() is used on unauthenticated gRPC channels without TLS in the policy server. An unauthenticated attacker can achieve arbitrary code execution by sending a crafted pickle payload.

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint. Unauthenticated attackers can take over any account including admin.

Windmill versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to leak the JWT signing secret, forge administrative tokens, and achieve remote code execution.

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows Operator role users to create scripts and execute code via the API, despite documentation stating operators cannot create or modify entities.

OmniGen2-RL reward server contains an unauthenticated remote code execution vulnerability. The Flask-based reward proxy and worker servers deserialize raw HTTP POST bodies with pickle.loads() without any authentication, giving instant code execution to anyone with network access.

Keygraph Shannon contains a hard-coded API key in its router configuration. When the router component is exposed, attackers can authenticate using the publicly known static key and proxy requests through the victim's upstream provider API credentials. Found it while casually reading source code. The fix? Bind to localhost. The key is still hard-coded.

Windmill versions prior to 1.603.3 contain an unauthenticated path traversal vulnerability in the get_log_file endpoint. The filename parameter is concatenated into a file path without sanitization, allowing arbitrary file read via ../ sequences. When SUPERADMIN_SECRET is configured (always the case in Nextcloud Flow), this leads to full RCE through credential theft and the job execution API.

openDCIM report_network_map.php reads the dot config value from fac_Config and passes it directly to exec() without validation. Combined with CVE-2026-28516, an attacker can overwrite the value and achieve RCE.

openDCIM Config::UpdateParameter() uses string interpolation in SQL queries. PDO with MySQL supports stacked queries, giving full database control via the LDAP configuration form in install.php.

openDCIM install.php performs no role check before the LDAP configuration form, allowing any authenticated user (or unauthenticated on Docker deployments) to reach Config::UpdateParameter() calls.

SPIP interface_traduction_objets plugin <= 2.2.1 is vulnerable to authenticated blind SQL injection. The id_parent parameter from _request() is concatenated raw into a sql_getfetsel WHERE clause without intval() or sql_quote().

SPIP jeux plugin <= 4.1.0 is vulnerable to reflected XSS. The debut_index_jeux and index_jeux parameters are interpolated unsanitized into a single-quoted HTML id attribute, allowing attribute breakout and script injection.

SPIP interface_traduction_objets plugin <= 2.2.1 is vulnerable to authenticated remote code execution. The lang_dest parameter is concatenated raw into _hidden, which skips protege_champ() and renders with interdire_scripts=false, enabling PHP code injection via SPIP's template eval() chain.

SPIP tickets plugin <= 4.3.2 is vulnerable to unauthenticated remote code execution. During forum comment preview, raw _request() values are concatenated into the previsu error key, which is rendered via #ENV** (interdire_scripts=false), allowing PHP code injection through SPIP's template eval() chain.

SPIP referer_spam plugin <= 1.2.1 is vulnerable to unauthenticated blind SQL injection. Two action handlers take $_GET['url'] and concatenate it raw into SQL LIKE clauses without sql_quote(), securiser_action(), or autoriser().

MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method is reachable without authentication, enabling recursive deletion of module files, templates, and database records.

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method without authentication, allowing an attacker to poison the update URL, serve a malicious tarball, and trigger deployment to the webroot.

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The $_GET['parent'] parameter is directly interpolated into multiple SQL queries without sanitization. Admin passwords are stored as unsalted MD5 hashes.

MajorDoMo (aka Major Domestic Module) contains a stored XSS vulnerability through method parameter injection into the shoutbox. Default methods pass attacker-controlled parameters into say(), which stores messages raw. The dashboard widget auto-refreshes every 3 seconds, firing the XSS automatically.

MajorDoMo (aka Major Domestic Module) contains a stored XSS vulnerability via the unauthenticated /objects/?op=set endpoint. Property values are stored raw and rendered without escaping in the admin panel's property editor, enabling session hijack via cookie exfiltration.

MajorDoMo (aka Major Domestic Module) contains a reflected cross-site scripting (XSS) vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without htmlspecialchars().

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable is interpolated into a command string within double quotes without escapeshellarg(), queued via safe_exec(), and executed by the web-accessible cycle_execs.php worker via exec().

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach eval() via register_globals parameters.

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. The server explicitly refuses to bind to localhost, ensuring these endpoints are always network-exposed.

manga-image-translator version beta-0.3 and prior in shared API mode contains an unsafe deserialization vulnerability via pickle.loads() on two FastAPI endpoints, combined with a nonce authentication bypass that defaults to an empty string, allowing unauthenticated remote code execution.

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.

Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities that allow an authenticated attacker to write arbitrary files to the server filesystem.

AVideo versions prior to 20.0 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

AVideo versions prior to 20.0 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.

AVideo versions prior to 20.0 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.

AVideo versions prior to 20.0 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can craft a link to redirect users to arbitrary external sites, enabling phishing attacks.

AVideo versions prior to 20.0 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

AVideo versions prior to 20.0 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.

AVideo versions prior to 20.0 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.

AVideo versions prior to 20.0 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.

AVideo versions prior to 20.0 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal `date -s` command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code execution.

The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter. Input is processed unsafely during network setup, allowing attackers to execute arbitrary system commands with root privileges.

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in WISP mode, the 'ssid' parameter is passed unsanitized to system-level scripts. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root, resulting in full device compromise.

ICTBroadcast <= 7.4 is vulnerable to an unauthenticated remote code execution. The /login.php page issues a session cookie, and certain cookie keys are evaluated using shell backticks in server-side code. This allows attackers to inject arbitrary system commands into the cookie, resulting in code execution during session handling, without authentication.

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in Extender mode via its captive portal, the extap2g SSID field is inserted unescaped into a reboot-time shell script. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root during device reboot, leading to full system compromise.

Vembu BDRSuite <= 7.5.0.1 contains an unauthenticated stored XSS in restoreprogress.sgp through multiple unsanitized URL parameters.

Vembu BDRSuite <= 7.5.0.1 is affected by an unauthenticated stored XSS in serverbackupprogress.sgp via the ClientName and BackupName parameters.

Xorcom CompletePBX 5.2.35 is vulnerable to an authenticated reflected XSS, allowing JavaScript injection via crafted input.

Xorcom CompletePBX <= 5.2.35 is affected by a path traversal vulnerability allowing authenticated file deletion and access to arbitrary paths.

Xorcom CompletePBX <= 5.2.35 contains an authenticated command injection vulnerability, leading to remote code execution via system commands.

Xorcom CompletePBX <= 5.2.35 is vulnerable to authenticated file disclosure, allowing access to sensitive files through crafted requests.

MagnusBilling 7.3.0 and lower contains a stored XSS vulnerability in the Alarm module. Unsanitized message fields can lead to arbitrary JavaScript execution when viewed by an administrator.

MagnusBilling 7.3.0 and lower is vulnerable to an unauthenticated stored XSS via the login logs feature. Malicious input submitted as a username during login is stored and later executed in the admin context.

Themify Builder < 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue.

Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, leading to remote code execution (RCE).

Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php.

SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.

SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering.

SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component.

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component.

Directory Traversal vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component.

An issue in WWBN AVideo v12.4 through v14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.