43 matches found
CVE-2026-54237
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237
Wavelog is web-based amateur radio logging software. Versions 1.8 through 2.4.2 leave /install/ajax.php and /install/includes/interface_assets/triggers.php accessible after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile...
EUVD-2026-82421
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237: Improper Control of Generation of Code
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
EUVD-2024-49239
Malicious code in bioql PyPI...
CVE-2024-48249
Wavelog 1.8.5 allows Gridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-8521
A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live QSO. The manipulation of the argument manual leads to cross site scripting. It is possible to launch the attack remotely. The exploit has...
CVE-2024-48251
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48251
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48249
Wavelog 1.8.5 allows Gridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48251: Improper Neutralization of Special Elements used in an SQL Command
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48257: Improper Neutralization of Special Elements used in an SQL Command
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48249: Improper Neutralization of Special Elements used in an SQL Command
Wavelog 1.8.5 allows Gridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
Wavelog 安全漏洞
Wavelog is a web-based amateur radio logging software from Wavelog Open Source. A security vulnerability exists in Wavelog version 1.8.5, which stems from an SQL injection vulnerability contained in the stationid parameter in the getworkedmodes function on the Oqrsmodel.php page...