A cross-site scripting (XSS) vulnerability exists in the Wireless Settings component of Netis WF2409E version 3.3.42541. The vulnerability arises from improper handling of the SSID argument, allowing remote attackers to inject malicious scripts. The exploit code is publicly available, but the vendor has not responded or issued a fix. The CVSS score is 3.5, indicating a low severity risk.
A critical command injection vulnerability exists in Linksys E1700 firmware version 1.0.0.4.003. The flaw is in the setLinksysIpv6 function, where manipulation of the _6rd_prefix or _6rd_prefix_len parameters allows remote attackers to execute arbitrary OS commands. The vulnerability has a high CVSS score of 9.9 and the exploit code has been publicly disclosed. The vendor has not responded to disclosure requests and no patch information is available.
AnyDesk versions prior to 8.0.3 contain a critical heap-based buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code as root on Linux systems without user approval. The flaw exists in the stream packet handler for mode 5 in the session protocol, where a payload length value is not properly validated.
Thelia version 2.6.1 has an absolute path traversal vulnerability in its Smarty template handling. This flaw allows an authorized user to supply an absolute filesystem path as a template, bypassing the relative path traversal checks. As a result, Smarty loads and compiles the specified file without effective security restrictions, potentially enabling server-side template injection (SSTI) and remote code execution with the web server's privileges.
Thelia version 2.6.0 allows authenticated administrators to upload and install modules via a ZIP upload function without proper validation or sandboxing of embedded PHP code. This vulnerability enables execution of malicious PHP code included in a module's install() method during installation, resulting in remote code execution with the web server's privileges.
Thelia version 2.6.1 contains chained vulnerabilities in its translation editor that allow an authenticated user with specific update permissions to perform path traversal and PHP code injection. These vulnerabilities enable writing malicious PHP files to web-accessible locations, leading to remote code execution with the web server's privileges.
Thelia version 2.6.0 contains a reflected Cross-Site Scripting (XSS) vulnerability in its Smarty templates (address.html and address-update.html). The issue arises because the "next" parameter is not properly escaped for double quotes, allowing an attacker to inject malicious JavaScript code that executes when an authenticated user visits a crafted link.
Thelia 2.6.0 uses the Smarty templating engine for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions via the messages configuration interface. When these templates are previewed or rendered, functions like system(), exec(), file_put_contents(), and file_get_contents() can be executed with the web server's privileges, enabling arbitrary OS command execution and file read/write operations on the server.
Thelia v2.6.0 has a vulnerability where the administrative login and forgotten password endpoints respond differently to invalid usernames versus incorrect passwords. This behavior allows unauthenticated attackers to enumerate valid administrator usernames. Additionally, the endpoints lack rate limiting or protections against repeated authentication attempts, enabling efficient large-scale username enumeration.
Thelia version 2.6.0 contains multiple stored cross-site scripting (XSS) vulnerabilities in its administrative interface. These vulnerabilities arise from insufficient output encoding or sanitization of user-supplied input, which is stored and later rendered in administrator pages and product pages. This allows arbitrary JavaScript execution when the affected pages are viewed, impacting administrative functions such as category and product creation.
Thelia version 2.6.0 has an open redirect vulnerability in its address creation workflow. When a user submits the 'Add New Address' form via a crafted URL containing a 'next' parameter, the application redirects the user to the URL specified in that parameter without validating its destination. This allows attackers to redirect users to arbitrary external websites controlled by the attacker.
Thelia version 2.6.0 contains a vulnerability in its store banner upload feature where filetype validation relies solely on client-supplied MIME types. This insufficient validation allows an attacker with administrative privileges to upload a malicious PHP file disguised as an image, potentially leading to remote code execution on the server.
A deserialization of untrusted data vulnerability exists in the Ministry of Justice General Directorate of Information Technology UYAP Document Editor before version 5.4.20. This vulnerability allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 (CVSS 3.1).
CVE-2026-18390 is an OS command injection vulnerability in the UYAP Document Editor used by the Ministry of Justice General Directorate of Information Technology. The vulnerability arises from improper neutralization of special elements in OS commands, allowing potential injection attacks. It affects versions of UYAP Document Editor before 5.4.20. The vulnerability has a high severity with a CVSS score of 7.8. No patch or remediation information is currently provided.
Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities affecting file management, Smarty templating, module installation, and administrative workflows. These include remote code execution, server-side template injection, stored and reflected cross-site scripting, open redirect, and username enumeration. Exploitation requires authenticated administrative access for most issues, but some vulnerabilities enable unauthenticated attackers to enumerate valid admin usernames. No patch is currently available, and risk mitigation involves restricting administrative interface access and disabling or limiting certain features.
An improper certificate validation vulnerability exists in hexpm's hex_core library affecting versions before 0.20.0. This flaw allows an attacker who can intercept HTTPS connections to impersonate hex.pm or related repositories when using hex_core's default HTTP adapter on Erlang/OTP 24 or OTP 25 without a loaded CA certificate store. The issue arises because the default HTTP adapter falls back to insecure SSL options that do not verify server certificates in these environments. hex_core 0.11.0 and later added secure SSL defaults for OTP 25+, but earlier versions remain vulnerable. The vulnerability is documented but the warnings and README do not clearly communicate the lack of certificate verification under certain conditions.
A critical stack-based buffer overflow vulnerability exists in the Linksys E1700 firmware version 1.0.0.4.003, specifically in the ssid1MACFilter function of the Mac Filter component. This vulnerability can be triggered remotely by manipulating the newap_text_%d argument. The flaw has a CVSS score of 10.0, indicating it allows complete compromise of confidentiality, integrity, and availability. The vendor has not responded to disclosure attempts, and no patch information is available. Exploit code has been publicly disclosed, but no known active exploitation in the wild is reported.
A vulnerability in BlackBeltTechnology pi-agent-dashboard up to version 0.8.0 affects the terminalManager.spawn function in the Terminal Handler component. The issue involves improper authorization due to manipulation of the cwd argument and can be exploited remotely. A patch has been released promptly by the vendor to address this issue.
A deserialization of untrusted data vulnerability (CVE-2026-52903) exists in ManageIQ due to the YamlLoadAliases module overriding YAML.safe_load to fallback to YAML.unsafe_load in production. An authenticated attacker with dialog import access can exploit this by uploading a crafted YAML payload, leading to remote code execution. Red Hat CloudForms, based on ManageIQ, is end-of-life and no patches will be issued for it. This CVE is assigned for the benefit of the ManageIQ community and downstream users.
Open Source Social Network (OSSN) versions up to 10.1 have a missing authorization vulnerability in the ossn_album_page_handler component. This flaw allows unauthenticated attackers to download files via album/getphoto and album/getcover endpoints. Attackers can enumerate sequential file GUIDs to access friends-only album photos and other stored files without any access control checks. The vulnerability has a CVSS 3.1 score of 5.3, indicating medium severity.