rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-24413 Icinga has insecure permission of %ProgramData%\icinga2\var on Windows
Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set appropriate permissions for the `%ProgramData%\icinga2\var` folder on Windows. This resulted in the its contents - including the private key of the user and synced configuration - being readable by all local users. All installations on Windows are affected. Versions 2.13.14, 2.14.8, and 2.15.2 contains a fix. There are two possibilities to work around the issue without upgrading Icinga 2. Upgrade Icinga for Windows to at least version v1.13.4, v1.12.4, or v1.11.2. These version will automatically fix the ACLs for the Icinga 2 agent as well. Alternatively, manually update the ACL for the given folder `C:\ProgramData\icinga2\var` (and `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` to fix the issue for the Icinga for Windows as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Icinga
product: icinga2
Published: 2026-01-29T17:21:01.438Z
CVE-2026-24414 Icinga for Windows certificate can have too-open permissions
The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of Windows environments. In versions prior to 1.13.4, 1.12.4, and 1.11.2, permissions of the Icinga for Windows `certificate` directory grant every user read access, which results in the exposure of private key of the Icinga certificate for the given host. All installations are affected. Versions 1.13.4, 1.12.4, and 1.11.2 contains a patch. Please note that upgrading to a fixed version of Icinga for Windows will also automatically fix a similar issue present in Icinga 2, CVE-2026-24413. As a workaround, the permissions can be restricted manually by updating the ACL for the given folder `C:\Program Files\WindowsPowerShell\modules\icinga-powershell-framework\certificate` (and `C:\ProgramData\icinga2\var` to fix the issue for the Icinga 2 agent as well) including every sub-folder and item to restrict access for general users, only allowing the Icinga service user and administrators access.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: Icinga
product: icinga-powershell-framework
Published: 2026-01-29T17:35:43.323Z
CVE-2026-24415 OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contains Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the righe GET parameter before reflecting it in HTML output.The $_GET['righe'] parameter is directly echoed into the HTML value attribute without any sanitization using htmlspecialchars() or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: devcode-it
product: openstamanager
Published: 2026-03-03T21:51:41.971Z
CVE-2026-24416 OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application fails to properly sanitize the idarticolo parameter before using it in SQL queries, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: devcode-it
product: openstamanager
Published: 2026-02-06T18:08:44.717Z
CVE-2026-24417 OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the term parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: devcode-it
product: openstamanager
Published: 2026-02-06T18:07:52.247Z
CVE-2026-24418 OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the id_records array are integers before using them in an SQL IN() clause, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: devcode-it
product: openstamanager
Published: 2026-02-06T18:06:47.383Z
CVE-2026-24419 OpenSTAManager has an SQL Injection in the Prima Nota  module
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the Prima Nota (Journal Entry) module's add.php file. The application fails to validate that comma-separated values from the id_documenti GET parameter are integers before using them in SQL IN() clauses, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: devcode-it
product: openstamanager
Published: 2026-02-06T18:05:42.332Z
CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: thorsten
product: phpMyFAQ
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-01-24T01:57:28.369Z
CVE-2026-24421 phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: thorsten
product: phpMyFAQ
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-01-24T01:43:10.011Z
CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions
phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: thorsten
product: phpMyFAQ
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2026-01-24T02:02:30.588Z
CVE-2026-24423 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: SmarterTools
product: SmarterMail
default_status: unaffected
Credits: lang: en
value: Sina Kheirkhah & Piotr Bazydlo of watchTowr
lang: en
value: Markus Wulftange of CODE WHITE GmbH
lang: en
value: Cale Black of VulnCheck
Published: 2026-01-23T16:53:34.951Z
CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.
Problem types: cwe_id: CWE-693
description: CWE-693 Protection Mechanism Failure
Affected products: vendor: twigphp
product: Twig
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Nicolò Ribaudo
lang: en
value: Fabien Potencier
lang: en
value: VulnCheck
Published: 2026-05-20T13:45:02.413Z
CVE-2026-24426 Tenda AC7 Reflected XSS via Web Interface Output Encoding
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior contain an improper output encoding vulnerability in the web management interface. User-supplied input is reflected in HTTP responses without adequate escaping, allowing injection of arbitrary HTML or JavaScript in a victim’s browser context.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: Tenda AC7
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-02-03T19:09:37.339Z
CVE-2026-24427 Tenda AC7 Exposes Admin Credentials in Configuration Responses
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses. Administrative credentials, including the router and/or admin panel password, are included in plaintext within configuration response bodies. In addition, responses lack appropriate Cache-Control directives, which may permit web browsers to cache pages containing these credentials and enable subsequent disclosure to an attacker with access to the client system or browser profile.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: Tenda AC7
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-02-03T19:11:32.297Z
CVE-2026-24428 Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an attacker can bypass role-based restrictions enforced by the web interface and obtain full administrative privileges.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:39:45.357Z
CVE-2026-24429 Tenda W30E V2 Hardcoded Default Password for Built-in Account
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default credentials to gain authenticated access to the management interface.
Problem types: cwe_id: CWE-1393
description: CWE-1393: Use of Default Password
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:39:02.845Z
CVE-2026-24430 Tenda W30E V2 HTTP Responses Expose Plaintext Credentials
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be exposed to network-based interception.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:39:14.924Z
CVE-2026-24431 Tenda W30E V2 Web UI Reveals Passwords in Cleartext
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials.
Problem types: cwe_id: CWE-317
description: CWE-317 Cleartext Storage of Sensitive Information in GUI
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:40:41.464Z
CVE-2026-24432 Tenda W30E V2 Missing CSRF Protections for Administrative Actions
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those used to change administrator account credentials. As a result, an attacker can craft malicious requests that, when triggered by an authenticated user’s browser, modify administrative passwords and other configuration settings.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:46:54.531Z
CVE-2026-24433 Tenda W30E V2 Stored XSS via Username Field
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality. Insufficient input validation allows attacker-controlled script content to be stored and later executed when administrative users access the affected management pages.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:40:59.149Z
CVE-2026-24434 Tenda AC7 Web Interface Lacks CSRF Protections for Admin Actions
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior does not implement CSRF protections for administrative functions in the web management interface. The interface does not enforce anti-CSRF tokens or robust origin validation, which can allow an attacker to induce a logged-in administrator to perform unintended state-changing requests and modify router settings.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: Tenda AC7
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-02-03T19:13:01.162Z
CVE-2026-24435 Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endpoints. The device sets Access-Control-Allow-Origin: * in combination with Access-Control-Allow-Credentials: true, allowing attacker-controlled origins to issue credentialed cross-origin requests.
Problem types: cwe_id: CWE-942
description: CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:49:03.354Z
CVE-2026-24436 Tenda W30E V2 Lacks Rate Limiting on Authentication
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:40:04.668Z
CVE-2026-24437 Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives. As a result, browsers may store credential-bearing responses locally, exposing them to subsequent unauthorized access.
Problem types: cwe_id: CWE-525
description: CWE-525 Use of Web Browser Cache Containing Sensitive Information
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:40:22.992Z
CVE-2026-24439 Tenda W30E V2 Lacks X-Content-Type-Options Header
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable script.
Problem types: cwe_id: CWE-116
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, Security Researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:48:37.336Z
CVE-2026-24440 Tenda W30E V2 Allows Password Changes Without Verifying Current Password
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained.
Problem types: cwe_id: CWE-620
description: CWE-620 Unverified Password Change
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: W30E V2
default_status: unknown
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-01-26T17:38:44.054Z
CVE-2026-24441 Tenda AC7 Transmits Admin Credentials Without HTTPS Protection
Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose account credentials in plaintext within HTTP responses, allowing an on-path attacker to obtain sensitive authentication material.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Shenzhen Tenda Technology Co., Ltd.
product: Tenda AC7
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
Published: 2026-02-03T19:14:41.224Z
CVE-2026-24443 EventSentry < 6.0.1.20 Web Reports Unverified Password Change
EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password before allowing a new password to be set. An attacker who gains temporary access to an authenticated user session can change the account password without knowledge of the original credentials. This enables persistent account takeover and, if administrative accounts are affected, may result in privilege escalation.
Problem types: cwe_id: CWE-620
description: CWE-620 Unverified Password Change
Affected products: vendor: NETIKUS.NET ltd
product: EventSentry
default_status: unaffected
Credits: lang: en
value: Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
lang: en
value: VulnCheck
Published: 2026-02-24T20:14:44.688Z