CVE Vulnerability Advisory Database

[Affected Scope] WAVLINK WL-WN530HG4B router with firmware version M_V260724.

[Impact] Authenticated remote attackers can exploit the 'Name' parameter within the port forwarding function of '/cgi-bin/wapi.cgi' to execute arbitrary OS commands with root privileges.

[Mitigation] Restrict access to the router's management interface, apply firewall rules to block malicious payloads, and upgrade to the latest patched firmware version.

[Affected Scope] Wavlink WN579X3-D V250402 firmware version.

[Impact] An authenticated remote attacker can manipulate the 'Name' parameter in the port forwarding configuration API to execute arbitrary OS commands with root privileges.

[Mitigation] Restrict external access to the router's management interface and apply the latest firmware patch from the vendor immediately.

[Affected Scope] WAVLINK WL-WN579A3-A firmware version 2026-03-10-94f93d4 and prior.

[Impact] Unauthenticated remote attackers can inject malicious OS commands to gain full root-level control over the device and compromise the internal network.

[Mitigation] Disable remote WAN management, restrict access to the administration interface, and monitor network traffic for suspicious CGI requests.

[Affected Scope] D-Link DIR-505 firmware version 1.10B02 and prior

[Impact] Unauthenticated remote attackers can execute arbitrary system commands or gain full control of the device by sending crafted filenames via TFTP

[Mitigation] Disable the vulnerable TFTP service immediately, restrict access via firewall rules, and upgrade to a patched firmware or replace the legacy device

[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module

[Impact] Unrestricted Remote Code Execution (RCE) via gadget chains due to unfiltered deserialization of frame bytes from untrusted peers

[Mitigation] Decommission the unsupported 3.0.0 branch and migrate to the actively maintained Apache MINA 2.2.X branch

[Affected Scope] Jpom versions 2.10.0 through 2.11.12

[Impact] Unauthenticated remote attackers can bypass authentication to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header, leading to arbitrary command execution via script features

[Mitigation] Immediately upgrade Jpom to the patched version (2.11.13 or later) and restrict external access to the management console

[Affected Scope] Perl-based web applications utilizing WebDyne versions 2.031 through 3.021

[Impact] Remote attackers can bypass file upload restrictions using double extensions (e.g., .psp.pdf) to execute arbitrary Perl code on the server, leading to full system compromise

[Mitigation] Immediately upgrade the WebDyne framework to the patched version 3.022 or higher

[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021

[Impact] Unauthenticated remote attackers can execute arbitrary Perl code via path traversal, leading to full system compromise

[Mitigation] Immediately upgrade WebDyne to version 3.022 or higher, and restrict script execution in upload directories

[Affected Scope] PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin versions up to, and including, 7.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the server and fully compromise the system via malicious payload injection

[Mitigation] Immediately upgrade the plugin to the patched version (7.2.0 or higher) and apply input validation filters on checkout API requests

[Affected Scope] All websites and e-commerce stores running Vvveb CMS versions prior to 1.0.8.7

[Impact] Remote attackers can bypass authentication to reset any user's password, leading to full account takeover including administrative privileges.

[Mitigation] Immediately upgrade Vvveb CMS to version 1.0.8.7 or later.

[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).

[Impact] Authenticated users can escalate to 'superuser operator' privileges, leading to full system compromise and data breach.

[Mitigation] Apply official security patches immediately and restrict network access to the management interface.

[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0

[Impact] Remote unauthenticated attackers can corrupt decoder state memory via crafted compressed streams, leading to sensitive data disclosure, DoS, or Remote Code Execution (RCE)

[Mitigation] Immediately update Brotli libraries and dependent packages to the latest secure versions (1.0.10, 1.1.1, 1.2.1 or higher)

[Affected Scope] All web applications and server environments running on the PHP engine.

[Impact] Unauthenticated remote attackers can trigger Out-of-Memory (OOM) conditions to execute arbitrary code (RCE) with system privileges.

[Mitigation] Immediately apply official PHP security patches and restrict abnormal memory allocation via php.ini configurations.

[Affected Scope] Internal messaging components of BeyondTrust Remote Support appliances.

[Impact] Unauthenticated remote attackers can bypass authentication via origin spoofing to perform arbitrary file operations, leading to full system compromise.

[Mitigation] Immediately apply the vendor-provided security patch (KB0024066) and restrict access to the management interface.

[Affected Scope] All versions of Cisco Secure Email Gateway with Advanced Malware Protection (AMP) and File Reputation service enabled.

[Impact] An unauthenticated remote attacker can overwrite system files and execute arbitrary commands with root privileges by sending a crafted email attachment.

[Mitigation] Immediately apply the official AsyncOS security patches provided by Cisco. If patching is not possible, disable the AMP File Reputation feature as a temporary workaround.

[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, leading to full system compromise.

[Mitigation] Update the richdocumentscode app to version 26.4.303 or later immediately.

[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)

[Impact] Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise

[Mitigation] Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory

[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands by manipulating API arguments, leading to full system compromise

[Mitigation] Immediately upgrade to version 9.15.2.70 or 10.3.4.45 or later

[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.

[Impact] Unauthenticated remote attackers can write arbitrary files via crafted HTTP/HTTPS requests, leading to full system compromise and Remote Code Execution (RCE).

[Mitigation] Immediately upgrade to patched firmware versions (8.0.2, 7.6.7, etc.) and restrict access to administrative interfaces.

[Affected Scope] Zammad versions 6.3.0 to 6.5.4 (7.0.0 to 7.1.2 are vulnerable but currently non-exploitable)

[Impact] Unauthenticated attackers can hijack user sessions and execute arbitrary code with 'zammad' user privileges.

[Mitigation] Immediately update to the latest patched versions (6.5.5+ or 7.1.3+).