50 matches found
CVE-2026-54237
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237
Wavelog is web-based amateur radio logging software. Versions 1.8 through 2.4.2 leave /install/ajax.php and /install/includes/interface_assets/triggers.php accessible after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile...
CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
EUVD-2026-82421
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
CVE-2026-54237
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
PT-2026-95089
Name of the Vulnerable Software and Affected Versions Wavelog versions 1.8 through 2.4.1 Description Wavelog exposes the endpoints '/install/ajax.php' and '/install/includes/interface assets/triggers.php' after installation without requiring an installation lock or permission check. Unsanitized...
CVE-2026-54237: Improper Control of Generation of Code
Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...
EUVD-2024-49239
Malicious code in bioql PyPI...
CVE-2024-48249
Wavelog 1.8.5 allows Gridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-8521
A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0. Affected is the function index of the file /qso of the component Live QSO. The manipulation of the argument manual leads to cross site scripting. It is possible to launch the attack remotely. The exploit has...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48251
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48251
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48257
Wavelog 1.8.5 allows Oqrsmodel.php getworkedmodes stationid SQL injectioin...
CVE-2024-48249
Wavelog 1.8.5 allows Gridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48251
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...
CVE-2024-48251: Improper Neutralization of Special Elements used in an SQL Command
Wavelog 1.8.5 allows Activatedgridmapmodel.php getbandconfirmed SQL injection via band, sat, propagation, or mode...