Threat database

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.  This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to download the uploaded file.  This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability in the countOfViewOptimization() function. This flaw can be triggered by attackers using a crafted SQL query or database file with a deeply nested TK_PLUS expression, causing recursive freeing operations that exhaust the C stack and crash the host process, resulting in denial of service.

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

vsftpd versions up to 3.0.5 have an access control bypass vulnerability where authenticated FTP users can execute commands that should be denied by using RFC 775 X-prefixed aliases. The vulnerability arises because the cmds_denied check only compares literal tokens, allowing commands like XRMD, XMKD, XCWD, XPWD, or XCUP to bypass restrictions and perform blocked operations such as deleting directories.

Prometheus versions up to 3.15.1 have a vulnerability where attackers can capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests. This occurs because the system insufficiently protects credentials, allowing attackers controlling the remote-write endpoint or a redirecting server to issue a 3xx redirect and replay the token to their own host.

Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership.

phpMyAdmin versions up to 5.2.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows database users with CREATE privileges to inject malicious scripts via unescaped table names in the DesignerHistory.display() function. When another user interacts with the affected table name in Designer query mode, the injected script executes in their session.

CVE-2026-119562 is an SQL injection vulnerability in phpMyAdmin versions up to 5.2.3. Authenticated users can exploit this flaw by supplying unescaped col_extra and col_attribute values to the /database/central-columns endpoint. This allows injection of SQL commands into INSERT and UPDATE queries executed with controluser privileges, potentially enabling unauthorized reading or modification of other users' configuration-storage data.

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.

OpenLiteSpeed versions up to 1.9.4 have an authentication bypass vulnerability in their HTTP/3 implementation. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting improper certificate validation in the QuicStream component. Specifically, QuicStream's verifyContext() method always returns true, enabling attackers to present a non-mTLS host's SNI with a protected Host header to access restricted content.