CVE Vulnerability Catalog

The Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 allows authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. It uses the workflow:read scope instead of workflow:execute, enabling an authenticated user with read-only access to trigger a real test run of the workflow.

FreeRDP before version 3.22.0 has a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.

A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to access sensitive organizational data of users via the RPC function public.get_orgs_v6. This function, defined as SECURITY DEFINER and granted to the anon role, does not verify that the user UUID matches the authenticated context.

Dell PowerProtect Data Domain in multiple versions contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell PowerProtect Data Domain in multiple versions contains an integer overflow or wraparound vulnerability. An unauthenticated remote attacker could exploit this flaw, leading to a denial of service (DoS).

In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

Dell PowerProtect Data Domain in multiple versions contains a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could exploit this flaw.

Omnissa Workspace ONE Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. An attacker with local access could exploit this flaw to gain elevated privileges.

A denial of service vulnerability has been addressed in Tanium Server. This flaw could allow an attacker to disrupt server operations.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The LatePoint plugin for WordPress up to version 5.4.0 has an improper input validation vulnerability in the Stripe Connect payment processor. This allows unauthenticated attackers to pay arbitrary amounts by supplying a previously successful PaymentIntent token.

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL injection via the 'mc_auth' parameter in versions up to and including 3.7.8. This is due to insufficient escaping and lack of proper SQL query preparation.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping and lack of proper query preparation.

The WCFM Membership plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 2.11.10. The 'wcfmvm_membership_change' AJAX action fails to validate user permissions to modify other users, allowing authenticated attackers with vendor-level access or higher to change any user's role to 'wcfm_vendor' by altering their membership plan.

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before version 2.0.8 allows authenticated X clients to execute code within the X server.

A heap buffer overflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows authenticated X clients to execute code within the X server.