CVE Vulnerability Advisory Database

[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).

[Impact] Authenticated users can escalate to 'superuser operator' privileges, leading to full system compromise and data breach.

[Mitigation] Apply official security patches immediately and restrict network access to the management interface.

[Affected Scope] All Cisco Secure Email Gateway appliances running vulnerable versions of Cisco AsyncOS Software.

[Impact] An unauthenticated remote attacker can execute arbitrary commands with root privileges by sending a crafted email, leading to full system compromise.

[Mitigation] Immediately apply the official security patches provided by Cisco and monitor for signs of exploitation.

[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions

[Impact] Remote, unauthenticated attackers can inject arbitrary SQL queries, manipulate the database, and gain full administrator access to the Metabase instance

[Mitigation] Apply the official vendor security patches immediately, or restrict access to the vulnerable endpoint using a WAF or reverse proxy

[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2

[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules

[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)

[Impact] Successful exploitation allows remote attackers to execute arbitrary SQL commands and retrieve sensitive database information when a plugin or theme passes untrusted input to the 'author__not_in' parameter of WP_Query.

[Mitigation] Immediately upgrade WordPress core to the patched versions (6.8.6, 6.9.5, or 7.0.2) and apply WAF filtering rules.

[Affected Scope] Sangoma Switchvox SMB Edition 8.3 (104997) and prior versions

[Impact] An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database, leading to full database compromise and remote code execution (RCE)

[Mitigation] Immediately upgrade to Switchvox version 8.4.0.2 or later, and restrict external access to the /pa endpoint

[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10

[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information, hijack administrator sessions, or potentially achieve Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Drupal core to the respective patched versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later).

[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7

[Impact] Unauthenticated attackers can read or modify the proxy's database, leading to unauthorized access to the proxy and managed API credentials

[Mitigation] Immediately upgrade LiteLLM to version 1.83.7 or later, and apply WAF rules to block malicious Authorization headers in the interim

[Affected Scope] Fortinet FortiClientEMS version 7.4.4

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges by sending crafted HTTP requests.

[Mitigation] Immediately apply the official vendor patches and restrict external access to the EMS management ports.

[Affected Scope] FreePBX endpoint module versions 15, 16, and 17

[Impact] Unauthenticated remote attackers can bypass authentication, manipulate the database, and execute arbitrary code with administrator privileges

[Mitigation] Immediately upgrade the FreePBX endpoint module to patched versions (15.0.66, 16.0.89, or 17.0.3) and restrict administrator access

[Affected Scope] Fortinet FortiWeb versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10

[Impact] An unauthenticated remote attacker can execute unauthorized SQL commands via crafted HTTP/HTTPS requests, potentially leading to sensitive data exposure, system compromise, and remote code execution (RCE).

[Mitigation] Immediately upgrade to the patched versions (7.6.4, 7.4.8, 7.2.11, 7.0.11 or higher) and restrict access to the management interface.

[Affected Scope] Advantive VeraCore through version 2025.1.0 affecting the timeoutWarning.asp component

[Impact] Unauthenticated remote attackers can execute arbitrary SQL commands via the PmSess1 parameter, leading to unauthorized data exposure

[Mitigation] Apply the official vendor security patch immediately, or implement WAF rules to block malicious payloads targeting the affected parameter

[Affected Scope] All vulnerable versions of Palo Alto Networks Expedition migration tool

[Impact] Unauthenticated remote attackers can extract database contents (password hashes, API keys) and read/write arbitrary files, leading to full system compromise

[Mitigation] Immediately upgrade Expedition to the latest patched version and restrict network access to trusted administrative hosts

[Affected Scope] All supported versions of Microsoft Configuration Manager (formerly SCCM)

[Impact] Unauthenticated remote attackers can execute arbitrary commands on the target server and backend database by sending specially crafted requests, leading to full system compromise

[Mitigation] Immediately apply the latest cumulative updates (KB) via the Configuration Manager console and restrict database access

[Affected Scope] Ivanti CSA (Cloud Services Appliance) versions prior to 5.0.2

[Impact] A remote authenticated attacker with administrative privileges can execute arbitrary SQL statements, potentially leading to sensitive data exposure and further system compromise.

[Mitigation] Immediately upgrade Ivanti CSA to version 5.0.2 or higher, and restrict external access to the admin console.

[Affected Scope] Progress WhatsUp Gold versions released before 2024.0.0

[Impact] An unauthenticated remote attacker can execute arbitrary SQL queries to retrieve sensitive database information, including encrypted user password hashes

[Mitigation] Immediately upgrade WhatsUp Gold to version 2024.0.0 or later and restrict database and web console access

[Affected Scope] Ivanti Endpoint Manager (EPM) 2022 SU5 and prior (Core Server component)

[Impact] Unauthenticated attackers within the same network can exploit an SQL injection vulnerability to execute arbitrary code with SYSTEM privileges

[Mitigation] Immediately apply the official security patch (EPM 2022 SU6 or later) and restrict network access to the Core Server

[Affected Scope] Fortinet FortiClientEMS versions 7.2.0 through 7.2.2, and 7.0.1 through 7.0.10

[Impact] An unauthenticated remote attacker can execute unauthorized code or system commands with database server privileges via specially crafted packets, leading to complete system compromise

[Mitigation] Immediately upgrade FortiClientEMS to patched versions (7.2.3+ or 7.0.11+) and restrict access to the management ports

[Affected Scope] F5 BIG-IP Configuration Utility (accessible via management ports and/or self IP addresses)

[Impact] Authenticated attackers with network access can exploit SQL injection to manipulate the database and execute arbitrary system commands with root privileges

[Mitigation] Apply official F5 security patches immediately and restrict access to the Configuration Utility (TMUI) using firewalls and ACLs

[Affected Scope] All Cyberoam Next-Generation Firewall (NGFW) appliances running Cyberoam OS released prior to 2020-12-04 with WebAdmin enabled

[Impact] Unauthenticated remote attackers can execute arbitrary SQL statements, bypass authentication, compromise the database, and gain full administrative control over the firewall appliance

[Mitigation] Apply the latest official Cyberoam OS security patches immediately and restrict external WAN access to the WebAdmin interface