Vulnerabilities

TI-2026-39140 CVE-2026-54237

Wavelog: Unauthenticated Remote Code Execution

MEDIUM 49

Wavelog is web-based amateur radio logging software.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00763 Published 2026-09-17 Fixed in 2.4.2 CWE-862

TI-2024-32335 CVE-2024-48257 · GHSA-528v-jf9w-58xh

HIGH 81

Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00659 Published 2024-10-14 No fix listed CWE-89

TI-2024-32332 CVE-2024-48251 · GHSA-3cr3-v8qm-wfcv

MEDIUM 49

Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00553 Published 2024-10-14 No fix listed CWE-89

TI-2024-32331 CVE-2024-48249 · GHSA-w475-fv8v-qxrm

HIGH 71

Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00434 Published 2024-10-14 No fix listed CWE-89

TI-2024-07899 CVE-2024-8521 · GHSA-wff2-3734-8hcr

MEDIUM 64

A vulnerability, which was classified as problematic, was found in Wavelog up to 1.8.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00568 Published 2024-09-07 No fix listed CWE-79