CVE-2026-54237

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2.

• CWE-94
• CWE-862

• https://github.com/wavelog/wavelog/commit/9661efa86eff4598bd1a7ad8ca4ec60e76b6fb25
• https://github.com/wavelog/wavelog/pull/3228
• https://github.com/wavelog/wavelog/releases/tag/2.4.2
• https://github.com/wavelog/wavelog/security/advisories/GHSA-jxjv-chgm-rh36

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54231A content injection vulnerability was found in the ABRT post…5.5
• CVE-2026-54232vLLM is an inference and serving engine for large language m…8.8
• CVE-2026-54233vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54234vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-54235vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-54236vLLM is an inference and serving engine for large language m…5.3
• CVE-2026-54239Faust.js is a headless WordPress toolkit. Prior to 1.8.11, t…8.8
• CVE-2026-54240libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54241libde265 is an open source implementation of the h.265 video…7.4
• CVE-2026-54242Statamic is a Laravel and Git powered content management sys…4.9
• CVE-2026-54243Statamic is a Laravel and Git powered content management sys…6.1
• CVE-2026-54244Statamic is a Laravel and Git powered content management sys…3.5