Vulnerability
Collabora Online Built-in CODE Server before version 26.4.303 is vulnerable to OS command injection in proxy.php when the CODE server is not running, allowing unauthenticated remote code execution. This flaw is actively exploited in production environments.
Vulnerability
An authenticated user can exploit SQL injection in VeloCloud Orchestrator to gain operator-level privileges and access internal functionality. This flaw is actively exploited and affects on-premises deployments across multiple versions.
Vulnerability
E-guardian SiteGuard Server Edition versions 2.20 through 8.00 contain an OS command injection vulnerability (CWE-78) exploitable by local users with low privileges. Attackers can execute arbitrary commands with root or SYSTEM level access, fully compromising the host system.
Vulnerability
Plex Media Server before version 1.43.3.10861 contains four distinct actively exploited vulnerabilities including arbitrary file write (CWE-73), server-side request forgery via two endpoints (CWE-918), and URL-scheme mishandling (CWE-84). Together, these allow admin users to achieve code e
Vulnerability
Siemens Software Center before version 4.0.9.8 searches for dynamic-link libraries (DLLs) in uncontrolled paths, allowing an authenticated local attacker to plant a malicious DLL and achieve code execution with the application's privileges. This is actively exploited.
Vulnerability
E-guardian SiteGuard Server Edition versions 2.20 through 8.00 contain an OS command injection flaw that allows a local attacker with low privileges to execute arbitrary commands as root or SYSTEM. This is actively exploited and requires immediate patching per CISA BOD 26-04 guidance.
Vulnerability
Plex Media Server before version 1.43.3.10861 contains four actively exploited vulnerabilities including arbitrary file execution, SSRF, URL manipulation, and plugin parameter injection. Together these flaws allow remote attackers to compromise the server and internal networks.
Vulnerability
Siemens Software Center versions before 4.0.9.8 load dynamic libraries from an uncontrolled search path, allowing an authenticated local attacker with high privileges to place a malicious DLL and achieve code execution. This is actively exploited.