CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack

[Impact] A local authorized attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise

[Mitigation] Apply the official Microsoft security updates immediately, or restrict local symbolic link creation privileges as a temporary mitigation

[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS

[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests

[Affected Scope] Ubiquiti UniFi OS devices accessible via the network

[Impact] Unauthenticated remote attackers can make unauthorized system changes, gain administrative control, and potentially enlist devices into botnets

[Mitigation] Apply the official vendor security patches immediately, restrict access to management interfaces, and monitor for unauthorized configuration changes

[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.

[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.

[Affected Scope] Oracle HTTP Server and WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 within Oracle Fusion Middleware.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to compromise the server, leading to unauthorized data modification, deletion, or complete system takeover with potential scope expansion to backend systems (CVSS 10.0).

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, restrict network access, and deploy WAF rules to filter malicious HTTP headers.

[Affected Scope] Triofox versions prior to 16.7.10368.56560

[Impact] Unauthenticated remote attackers can access initial setup pages even after installation is complete, potentially leading to full administrative takeover.

[Mitigation] Immediately upgrade Triofox to version 16.7.10368.56560 or later.

[Affected Scope] Windows and Windows Server systems running the Remote Access Connection Manager (RasMan) service

[Impact] An authorized local attacker can elevate privileges to SYSTEM, gaining full administrative control over the affected host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately, or disable the RasMan service as a temporary workaround

[Affected Scope] All Windows and Windows Server systems utilizing the SMBv3 protocol within Active Directory domains or workgroups

[Impact] An authenticated attacker with network access can exploit improper access control in SMB to elevate privileges to SYSTEM and execute arbitrary code

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately and restrict SMB (TCP 445) inbound traffic using firewalls

[Affected Scope] Projects running Vite development server exposed to the network (via --host or server.host configuration) using versions prior to 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11

[Impact] Remote attackers can bypass access restrictions and retrieve sensitive source code or system files by appending crafted query parameters (?inline&import or ?raw?import) to requests

[Mitigation] Immediately upgrade Vite to the patched versions (6.2.4, 6.1.3, 6.0.13, 5.4.16, or 4.5.11) and disable unnecessary external host binding (--host)

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-24989

[Impact] An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially byp...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] SonicWall Firewall Gen 5 and Gen 6 devices, and Gen 7 devices running SonicOS 7.0.1-5035 and older versions

[Impact] Unauthenticated remote attackers can gain unauthorized access to firewall resources and, under specific conditions, cause the firewall to crash, leading to a Denial of Service (DoS)

[Mitigation] Immediately apply the latest firmware patches provided by SonicWall, and restrict or disable WAN management access to the firewall

[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise

[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled

[Affected Scope] Adobe ColdFusion 2023 Update 6 and earlier, and ColdFusion 2021 Update 12 and earlier

[Impact] Unauthenticated attackers can bypass access controls to read or modify arbitrary files on the host system, potentially exposing sensitive configuration data

[Mitigation] Apply the official Adobe APSB24-14 security patch immediately and restrict external internet access to the ColdFusion administrator panel

[Affected Scope] Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier), and 2023u2 (and earlier)

[Impact] Unauthenticated remote attackers can bypass security filters to access administrative CFM and CFC endpoints, potentially leading to remote code execution (RCE)

[Mitigation] Immediately apply the official Adobe security patch (APSB23-47) and restrict external access to ColdFusion administrator consoles

[Affected Scope] Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier), and 2023.0.0.330468 (and earlier)

[Impact] Unauthenticated remote attackers can bypass security controls to access administrative CFM and CFC endpoints, potentially leading to full system compromise

[Mitigation] Apply the official Adobe security patches (APSB23-40) immediately and restrict external access to the ColdFusion Administrator interface

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.24

[Impact] Unauthenticated remote attackers can exploit a padding oracle vulnerability to bypass authentication, upload arbitrary files, and execute remote code with SYSTEM privileges

[Mitigation] Immediately upgrade customer-managed Storage Zones Controllers to version 5.11.24 or later, and restrict external access

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-27350

[Impact] This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentic...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Adobe ColdFusion 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier)

[Impact] Unauthenticated remote attackers can execute arbitrary code or access sensitive files in the context of the current user without any user interaction

[Mitigation] Immediately apply official vendor patches (ColdFusion 2018 Update 16, ColdFusion 2021 Update 6 or later) and restrict external access

[Affected Scope] Joomla! versions 4.0.0 through 4.2.7

[Impact] Unauthenticated remote attackers can bypass access controls to access sensitive API endpoints, exposing database credentials and system configuration details

[Mitigation] Immediately upgrade Joomla! to the patched version (4.2.8 or higher) and rotate all database credentials

[Affected Scope] Zabbix Frontend versions 5.4.0 to 5.4.8, and 6.0.0-alpha1 to 6.0.0-beta1

[Impact] Unauthenticated remote attackers can bypass step verification in setup.php to access configuration stages and potentially alter the Zabbix Frontend database connection settings

[Mitigation] Immediately upgrade Zabbix Frontend to patched versions (5.4.9, 6.0.0-beta2 or later) and restrict external access to the setup.php file via web server configuration