KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.
Wstrzyknięcie SQL w SKSPro umożliwia atakującym dostęp do bazy danych i potencjalne wykradanie danych.
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then…
A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the `@router.post("/reinstall_extension")` route. This vulnerability allows…
In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00465153;…
In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00464377;…
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access…
Twarde kodowanie konta i hasła w MagicInfo9 Server umożliwia manipulację bazą danych.
Luka w MagicInfo9 Server pozwala na przesyłanie plików HTML bez uwierzytelnienia, co prowadzi do XSS.
A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface. The manipulation results in improper authentication. The attack may…
Wykorzystanie podatności w SunFounder Pironman Dashboard pozwala na odczyt i usunięcie dowolnych plików.
AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a…
Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' parameter. Attackers can inject malicious SQL code into the 'fid' parameter to potentially extract,…
Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger…
Wstrzyknięcie argumentów w frameworku Cybersecurity AI umożliwia zdalne wykonanie kodu.
Wstrzyknięcie kodu w Orval umożliwia wykonanie dowolnego JavaScriptu przez nieodpowiednie oczyszczanie.
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.
Potencjalne wstrzyknięcie poleceń w Active Storage umożliwia niebezpieczne przetwarzanie obrazów.
aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php.
A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown processing of the file /enrollment/index.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the…
A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack can be…
After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a non-rejoinable state. If a suitable parent is not available, the end devices…
Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this vulnerability could allow remote SQL execution This issue affects *…
Brak uwierzytelnienia w punkcie końcowym Interinfo DreamMaker umożliwia zdalny dostęp do funkcji administracyjnych.
Nieograniczony upload niebezpiecznych plików w Interinfo DreamMaker umożliwia zdalne wykonanie poleceń.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2022-50981 An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced. |
Wysoki priorytet |
CVSS 9,8EPSS 0,59 % | ||
| CVE-2025-8587 Wstrzyknięcie SQL w SKSPro umożliwia atakującym dostęp do bazy danych i potencjalne wykradanie danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,35 % | ||
| CVE-2024-5986 A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject… |
Wysoki priorytet |
CVSS 9,1EPSS 0,7 % | ||
| CVE-2024-2356 A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the… |
Wysoki priorytet |
CVSS 9,6EPSS 0,89 % | ||
| CVE-2026-20418 In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User… |
Wysoki priorytet |
CVSS 9,8EPSS 0,36 % | ||
| CVE-2026-20407 In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User… |
Wysoki priorytet |
CVSS 9,3EPSS 0,18 % | ||
| CVE-2025-15030 The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing… |
Wysoki priorytet |
CVSS 9,8EPSS 0,53 % | ||
| CVE-2026-25202 Twarde kodowanie konta i hasła w MagicInfo9 Server umożliwia manipulację bazą danych. |
Wysoki priorytet |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-25200 Luka w MagicInfo9 Server pozwala na przesyłanie plików HTML bez uwierzytelnienia, co prowadzi do XSS. |
Wysoki priorytet |
CVSS 9,8EPSS 0,54 % | ||
| CVE-2026-1740 A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file /cgi/timepro.cgi of the component Hidden Hiddenloginsetup Interface.… |
Wysoki priorytet |
CVSS 9,8EPSS 0,55 % | ||
| CVE-2026-25069 Wykorzystanie podatności w SunFounder Pironman Dashboard pozwala na odczyt i usunięcie dowolnych plików. |
Wysoki priorytet |
CVSS 9,3EPSS 0,67 % | ||
| CVE-2020-37052 AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java… |
Wysoki priorytet |
CVSS 9,3EPSS 1,3 % | ||
| CVE-2020-37057 Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' parameter. Attackers can inject… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,56 % | ||
| CVE-2020-37027 Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can… |
Wysoki priorytet |
CVSS 9,3EPSS 2,58 % | ||
| CVE-2026-25130 Wstrzyknięcie argumentów w frameworku Cybersecurity AI umożliwia zdalne wykonanie kodu. |
Wysoki priorytet |
CVSS 9,6EPSS 0,91 % | ||
| CVE-2026-25141 Wstrzyknięcie kodu w Orval umożliwia wykonanie dowolnego JavaScriptu przez nieodpowiednie oczyszczanie. |
Wysoki priorytet |
CVSS 9,8EPSS 0,69 % | ||
| CVE-2026-1723 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through… |
Wysoki priorytet |
CVSS 9,2EPSS 1 % | ||
| CVE-2025-24293 Potencjalne wstrzyknięcie poleceń w Active Storage umożliwia niebezpieczne przetwarzanie obrazów. |
Wysoki priorytet |
CVSS 9,2EPSS 5,58 % | ||
| CVE-2025-51958 aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php. |
Wysoki priorytet |
CVSS 9,8EPSS 0,69 % | ||
| CVE-2026-1701 A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown processing of the file /enrollment/index.php. Such manipulation of… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,48 % | ||
| CVE-2026-1688 A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/index.php. The manipulation of… |
Krytyczne sygnałyPubliczny PoC |
CVSS 9,8EPSS 0,39 % | ||
| CVE-2025-7964 After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Router getting stuck in a… |
Wysoki priorytet |
CVSS 9,2EPSS 0,3 % | ||
| CVE-2025-26385 Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Successful exploitation of this… |
Wysoki priorytet |
CVSS 9,5EPSS 1,47 % | ||
| CVE-2026-24728 Brak uwierzytelnienia w punkcie końcowym Interinfo DreamMaker umożliwia zdalny dostęp do funkcji administracyjnych. |
Wysoki priorytet |
CVSS 9,3EPSS 0,52 % | ||
| CVE-2026-24729 Nieograniczony upload niebezpiecznych plików w Interinfo DreamMaker umożliwia zdalne wykonanie poleceń. |
Wysoki priorytet |
CVSS 10,0EPSS 0,37 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 10.11.2026, 15:32 UTC – 10.11.2026, 17:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.