CVE Vulnerability Advisory Database

[Affected Scope] code-projects Content Management System 1.0

[Impact] Unauthenticated remote attackers can manipulate the 'del' parameter to compromise the database, extract sensitive data, or potentially execute remote code

[Mitigation] Restrict external access to the vulnerable admin script and implement parameterized queries (Prepared Statements) in the source code

[Affected Scope] code-projects Content Management System (CMS) version 1.0.

[Impact] Unauthenticated remote attackers can manipulate the 'Value' parameter in search.php to execute arbitrary SQL commands, leading to sensitive data exposure, administrative privilege escalation, or system compromise.

[Mitigation] Implement parameterized queries (Prepared Statements) in the source code and deploy Web Application Firewall (WAF) rules to block malicious SQL injection payloads.

[Affected Scope] itsourcecode School Management System 1.0, specifically the /student/index.php endpoint.

[Impact] Unauthenticated remote attackers can manipulate the ID parameter to execute arbitrary SQL commands, leading to sensitive data exposure or potential Remote Code Execution (RCE) depending on database privileges.

[Mitigation] Implement parameterized queries (Prepared Statements) in the source code and deploy Web Application Firewall (WAF) rules to block malicious SQL payloads.

[Affected Scope] SmarterMail mail server software

[Impact] Unauthenticated remote attackers can upload arbitrary files to any location on the mail server, potentially leading to full Remote Code Execution (RCE)

[Mitigation] Immediately apply the latest official security patches and restrict external access to sensitive upload endpoints and admin interfaces

[Affected Scope] Zimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI

[Impact] Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround

[Affected Scope] All MongoDB Server versions v3.6+, v4.0+, v4.2+, and versions prior to v4.4.30, v5.0.32, v6.0.27, v7.0.28, v8.0.17, and v8.2.3

[Impact] An unauthenticated remote attacker can read uninitialized heap memory by sending crafted Zlib compressed protocol headers, potentially exposing highly sensitive system and session data

[Mitigation] Immediately upgrade MongoDB Server to the respective patched release versions (v4.4.30, v5.0.32, v6.0.27, v7.0.28, v8.0.17, v8.2.3, or later)

[Affected Scope] WatchGuard Firebox appliances running Fireware OS configured with IKEv2 mobile user VPN or branch office VPN using a dynamic gateway peer, or where these configurations were previously deleted but a static gateway peer VPN remains.

[Impact] A critical vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to trigger an out-of-bounds write (CWE-787) in the iked process via crafted IKEv2 packets, leading to arbitrary code execution (RCE) with root privileges.

[Mitigation] Since this vulnerability is actively exploited and listed in the CISA KEV catalog, immediately upgrade to the patched Fireware OS version and restrict or disable IKEv2 services where possible.

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] High-privileged attackers can exploit insufficient authorization to escalate privileges to root, leading to complete system compromise

[Mitigation] Apply the official security patches immediately and restrict network access to the management console

[Affected Scope] Roundcube Webmail versions before 1.5.12 and 1.6.x versions before 1.6.12

[Impact] Remote attackers can execute arbitrary JavaScript code in the context of the victim's browser session via a malicious SVG attachment, leading to session hijacking and unauthorized email access

[Mitigation] Immediately upgrade Roundcube Webmail to the patched versions 1.5.12 or 1.6.12

[Affected Scope] Apple devices running iOS/iPadOS prior to 18.7.3 and 26.2, macOS Tahoe prior to 26.2, and Safari prior to 26.2

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE), with active exploitation reported in highly targeted attacks

[Mitigation] Immediately apply the official security updates (version 26.2 / 18.7.3 or later) provided by Apple

[Affected Scope] Cisco Secure Email Gateway and Cisco Secure Email and Web Manager running Cisco AsyncOS Software with the Spam Quarantine feature enabled

[Impact] Unauthenticated, remote attackers can execute arbitrary system commands with root privileges on the underlying operating system

[Mitigation] Apply official Cisco security patches immediately, or restrict/disable external access to the Spam Quarantine feature as a temporary workaround

[Affected Scope] Specific versions of the ASUS Live Update client distributed prior to its End-of-Support (EOS) in October 2021

[Impact] Unauthorized modifications introduced via a supply chain compromise allow remote code execution and unintended malicious actions on targeted devices

[Mitigation] Since the product is End-of-Support, immediately uninstall the software and block update server communications at the network level

[Affected Scope] HPE OneView management platform and associated appliance software

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges, leading to full infrastructure compromise

[Mitigation] Apply official HPE security patches immediately and restrict access to the management interface from untrusted networks

[Affected Scope] Apple devices running versions prior to iOS 18.7.2, iPadOS 18.7.2, macOS Sequoia 15.7.2, and macOS Sonoma 14.8.2

[Impact] A malicious local application can exploit lock state validation flaws to corrupt shared memory, leading to privilege escalation and arbitrary code execution

[Mitigation] Immediately apply the official Apple security updates to transition to patched OS versions

[Affected Scope] Gladinet CentreStack and Triofox solutions prior to version 16.12.10420.56791

[Impact] Unauthenticated remote attackers can exploit hardcoded AES keys to read arbitrary local files and potentially achieve full system compromise

[Mitigation] Immediately upgrade to version 16.12.10420.56791 or later and restrict access to publicly exposed endpoints

[Affected Scope] Google Chrome and Chromium-based browsers (such as Microsoft Edge) on macOS prior to version 143.0.7499.110

[Impact] A remote attacker can trigger out-of-bounds memory access via a crafted HTML page, potentially leading to arbitrary code execution (RCE) or renderer process crashes

[Mitigation] Immediately update all Chromium-based browsers to the latest stable version (143.0.7499.110 or higher) and enforce automated update policies across the enterprise

[Affected Scope] All active deployments of Gogs Git service utilizing the vulnerable PutContents API.

[Impact] An authenticated attacker with low privileges can exploit improper symbolic link validation to overwrite arbitrary system files, leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Gogs to the latest patched version and restrict repository creation and write permissions for untrusted users.

[Affected Scope] FortiOS 7.0.0-7.0.17 / 7.2.0-7.2.11 / 7.4.0-7.4.8 / 7.6.0-7.6.3, FortiProxy 7.0.0-7.0.21 / 7.2.0-7.2.14 / 7.4.0-7.4.10 / 7.6.0-7.6.3, FortiSwitchManager 7.0.0-7.0.5 / 7.2.0-7.2.6.

[Impact] An unauthenticated remote attacker can bypass FortiCloud SSO authentication via a crafted SAML response message, gaining full administrative access to the affected device.

[Mitigation] Immediately upgrade to the patched firmware versions, or disable FortiCloud SSO login and restrict administrative access to trusted IP addresses as a temporary workaround.

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] All Array Networks ArrayOS AG appliances running versions prior to 9.4.5.9

[Impact] High-privileged attackers can execute arbitrary OS commands, leading to complete system compromise and webshell deployment

[Mitigation] Immediately upgrade ArrayOS AG to version 9.4.5.9 or higher and audit system logs for indicators of compromise