CVE-2023-4034

SQLi in Smartrise Document Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-2.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Digitatek

Products

Smartrise Document Management System

CVE-2026-44052

LDAP simple-bind password exposure in log output

Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4178

Authentication Bypass in Neutron Smart VMS

Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Neutron

Products

Smart Vms

CVE-2026-44063

LDAP filter injection

An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44050

Heap buffer overflow in CNID daemon comm_rcv()

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44049

Out-of-bounds write in convert_charset() null termination

An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-9152

Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction

A missing authentication vulnerability exists in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens, or any form of identity verification. An unauthenticated network attacker who can reference a target workspace's identifier can interact with that workspace's search index, crossing tenant boundaries. Successful exploitation allows reading a workspace's indexed contents (such as component data, project and folder names, and user metadata) and injecting, modifying, or deleting search index entries. These operations affect the search index only, not the underlying vault data, but they can disclose sensitive workspace information and compromise the integrity and availability of search results. Altium 365 cloud deployments are affected; on-premise Altium Enterprise Server is not affected.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Altium

Products

Altium 365

CVE-2023-4231

SQLi in Cevik Informatics' Online Payment System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cevik Informatics Online Payment System allows SQL Injection. This issue affects Online Payment System: before 4.09.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cevik

Products

Informatics Online Payment System

CVE-2026-44048

Stack buffer overflow via UCS-2 type confusion in convert_charset()

A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44047

SQL injection in MySQL CNID backend

An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44051

Arbitrary file read via attacker-controlled symlink creation

An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-22880

Mobile SSO authentication flow allows credential theft via malicious server

Mattermost Mobile Apps versions <=2.37 11.4 2.0.37 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to properly validate the SSO authentication callback origin which allows an attacker controlling a malicious Mattermost server to steal user credentials for a legitimate Mattermost server via relaying the SSO code exchange flow through the mobile application. Mattermost Advisory ID: MMSA-2025-00564

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mattermost

Products

Mattermost Mattermost Mobile

CVE-2026-44053

Weak cryptography in DHCAST128 UAM

Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or impersonate a user via cryptanalytic attack.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2026-44054

Predictable afpd session token

Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4406

XSS in KC Group's E-Commerce Software

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Kc Group E-commerce Software Project

Products

Kc Group E-commerce Software

CVE-2026-44074

Bitwise OR of errno values

Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4530

SQLi in Turna Media's Advertising Administration Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injection. This issue affects Advertising Administration Panel: before 1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Turnatasarim

Products

Advertising Administration Panel

CVE-2026-44055

Bitwise OR logic bug enables shell injection

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Netatalk

Products

Netatalk

CVE-2023-4531

SQLi in Mestavs E-commerce Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mestav

Products

E-commerce Software

CVE-2023-4541

SQLi in Weens Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ween

Products

Management Panel