CVE Vulnerability Catalog

The FormyChat WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects all versions up to and including 2.15.3.

The Advanced Forms WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.9.3.7.

The ElementInvader Addons for Elementor WordPress plugin contains a DOM-Based Cross-Site Scripting (XSS) vulnerability. The flaw arises from improper input neutralization during web page generation, allowing an attacker to inject malicious JavaScript code.

SSRF vulnerability in the WPJAM Basic plugin allows an attacker to send requests from the server to internal network resources. The issue affects versions up to and including 7.0.

The WPJAM Basic plugin version 7.0 and earlier contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

The Themify Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 7.7.4.

The Jobmonster plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This issue affects all versions up to and including 4.8.5.

The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. Manipulating the data value allows arbitrary OS commands to be executed as root.

The charging station does not require authentication for Bluetooth commands, allowing unauthorized devices to perform actions. The vulnerability enables sensitive information leakage, triggering reboots, or pushing a firmware update URL.

A weakness has been identified in waooAI waoowaoo up to version 0.4.1, where improper authentication occurs in the functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight in src/lib/api-auth.ts. Manipulation of the x-internal-user-id request argument allows remote authentication bypass. The exploit is publicly available and could be used for attacks.

A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.

A Server-Side Request Forgery (SSRF) protection bypass was found in the html_to_markdown expansion module of misp-modules. IPv4-mapped IPv6 addresses were not normalized before blocked-range checks, allowing attacks on loopback, internal, or link-local networks.

A flaw in the vllm-orchestrator-gateway component causes all incoming authorization headers and full chat payloads to be logged persistently, exposing bearer tokens and sensitive conversation content to any user with log access.

In Shibby Tomato up to version 1.28.0000, a vulnerability was found in the main function of the file www/apcupsd/tomatodata.cgi of the apcupsd component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is publicly available.

In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.

A vulnerability was found in the Isaiah library up to version 1.36.9 in the WebSocket connection authentication component. An unknown function in app/main.go allows improper authentication, exploitable remotely. A fix is pending in a pull request.

A missing authorization vulnerability was found in will-moss Isaiah up to version 1.36.9 in the Server.Handle function of app/server/server/server.go within the Master Websocket Handler component. Manipulation of the Agent argument allows remote exploitation without proper authorization.

The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.