CVE Vulnerability Advisory Database

[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS

[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests

[Affected Scope] Ubiquiti UniFi OS devices accessible via the network

[Impact] Unauthenticated remote attackers can make unauthorized system changes, gain administrative control, and potentially enlist devices into botnets

[Mitigation] Apply the official vendor security patches immediately, restrict access to management interfaces, and monitor for unauthorized configuration changes

[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6

[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.

[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.

[Affected Scope] Oracle HTTP Server and WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 within Oracle Fusion Middleware.

[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to compromise the server, leading to unauthorized data modification, deletion, or complete system takeover with potential scope expansion to backend systems (CVSS 10.0).

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, restrict network access, and deploy WAF rules to filter malicious HTTP headers.

[Affected Scope] EyouCMS up to version 1.7.1 and 5.0, specifically within the Member Avatar Handler component.

[Impact] Unauthenticated remote attackers can bypass access controls to upload arbitrary files or trigger file inclusion, leading to complete Remote Code Execution (RCE).

[Mitigation] Restrict external access to the vulnerable API endpoint, deploy WAF rules, and monitor for official vendor patches.

[Affected Scope] xiweicheng TMS up to and including version 2.28.0

[Impact] Unauthenticated remote attackers can upload arbitrary malicious files, leading to Remote Code Execution (RCE) on the target server

[Mitigation] Disable execution permissions on the upload directory, enforce strict file extension validation, or apply the latest security patches

[Affected Scope] code-projects Content Management System 1.0, specifically the /admin/edit_posts.php component.

[Impact] Remote attackers can bypass authorization to upload malicious PHP web shells, leading to arbitrary system command execution on the host server.

[Mitigation] Implement strict file extension validation in the source code, disable script execution in the upload directory, or deploy WAF rules.

[Affected Scope] Triofox versions prior to 16.7.10368.56560

[Impact] Unauthenticated remote attackers can access initial setup pages even after installation is complete, potentially leading to full administrative takeover.

[Mitigation] Immediately upgrade Triofox to version 16.7.10368.56560 or later.

[Affected Scope] Systems running unpatched versions impacted by CVE-2025-24989

[Impact] An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially byp...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] SonicWall Firewall Gen 5 and Gen 6 devices, and Gen 7 devices running SonicOS 7.0.1-5035 and older versions

[Impact] Unauthenticated remote attackers can gain unauthorized access to firewall resources and, under specific conditions, cause the firewall to crash, leading to a Denial of Service (DoS)

[Mitigation] Immediately apply the latest firmware patches provided by SonicWall, and restrict or disable WAN management access to the firewall

[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise

[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.24

[Impact] Unauthenticated remote attackers can exploit a padding oracle vulnerability to bypass authentication, upload arbitrary files, and execute remote code with SYSTEM privileges

[Mitigation] Immediately upgrade customer-managed Storage Zones Controllers to version 5.11.24 or later, and restrict external access

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-27350

[Impact] This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentic...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Citrix ShareFile Storage Zones Controller versions prior to 5.11.20

[Impact] Unauthenticated remote attackers can bypass access controls to compromise the storage zones controller, potentially leading to arbitrary code execution and data exfiltration

[Mitigation] Immediately upgrade to Citrix ShareFile Storage Zones Controller 5.11.20 or later, and restrict external access to administrative endpoints

[Affected Scope] QNAP QTS operating system and Helpdesk application versions prior to 3.0.3

[Impact] Unauthenticated remote attackers can exploit improper access control to gain elevated privileges or read sensitive system information

[Mitigation] Immediately update the QTS operating system and upgrade the Helpdesk application to version 3.0.3 or later

[Affected Scope] Citrix Workspace App for Windows before version 1904

[Impact] Unauthenticated remote attackers can exploit incorrect access control mechanisms to execute arbitrary code and gain full system privileges on the target host

[Mitigation] Immediately upgrade affected client installations to version 1904 or later, and restrict network access for unpatched endpoints

[Affected Scope] Sonatype Nexus Repository Manager versions prior to 3.15.0

[Impact] Unauthenticated remote attackers can execute arbitrary Groovy scripts and gain full system-level control by sending specially crafted HTTP POST requests

[Mitigation] Immediately upgrade to the latest stable version (3.15.0 or higher) or restrict external access to the vulnerable endpoints

[Affected Scope] Kaseya VSA R9.3 (before 9.3.0.35), R9.4 (before 9.4.0.36), and R9.5 (before 9.5.0.5)

[Impact] Unprivileged remote attackers can execute arbitrary PowerShell payloads with SYSTEM privileges on all managed endpoints

[Mitigation] Immediately upgrade Kaseya VSA servers to patched versions (9.3.0.35, 9.4.0.36, 9.5.0.5 or higher) and restrict external access

[Affected Scope] Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

[Impact] Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

[Affected Scope] ProFTPD version 1.3.5 with the mod_copy module enabled.

[Impact] Unauthenticated remote attackers can read or write arbitrary files, leading to sensitive data exposure or full system compromise via RCE.

[Mitigation] Upgrade to ProFTPD 1.3.5a or later, or disable the mod_copy module in the configuration file.