CVE Vulnerability Catalog

A vulnerability in Apache Camel (JMS components) allows deserialization of untrusted data by bypassing the CVE-2026-40860 fix. An attacker can publish a JMS ObjectMessage with a DefaultExchangeHolder object, which passes the allow-list check, and then write arbitrary data into the Camel Exchange, manipulating routing, headers, and properties.

Deserialization of untrusted data vulnerability in Apache Camel Hazelcast component. The default Hazelcast configuration applies no deserialization filter, allowing an attacker to achieve remote code execution by sending a crafted Java object to the Hazelcast cluster. Affects versions 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0.

Deserialization of untrusted data vulnerability in Apache Camel allows an attacker to trigger DNS queries by delivering a crafted Java payload. The issue stems from the default ObjectInputFilter pattern that permits java.net.URL and java.net.InetAddress classes, enabling data exfiltration via an out-of-band DNS side channel.

A vulnerability in Apache Camel allows remote code execution via deserialization of untrusted data in the camel-vertx-http component. An attacker can exploit a man-in-the-middle position or compromised backend to deliver a crafted Java object, leading to code execution on the Camel host.

An uncontrolled resource consumption vulnerability exists in Apache IoTDB. Some interfaces fail to impose reasonable limits on the time span and aggregation interval of queries, allowing an attacker to craft a request with extreme parameters, leading to Java heap exhaustion and DataNode crash.

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

A vulnerability was found in create-react-app up to version 5.0.1 on macOS. The startBrowserProcess function in openBrowser.js of the react-dev-utils component allows OS command injection. Remote exploitation is possible and the exploit is publicly available.

The Admin and Site Enhancements (ASE) WordPress plugin before version 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.

The FileOrganizer WordPress plugin before version 1.2.0 does not validate file types in several file management operations, allowing authenticated users with file manager access (which its premium add-on can extend to sub-administrator roles) to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file type validation to the upload operation.

The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escapes a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

The Ultimate Member WordPress plugin before version 2.12.0 fails to properly sanitize and escape custom textarea profile field values before outputting them on user profiles. This allows authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

The AllCoach WordPress plugin before version 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password. This allows unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

The Notifications for Forms & WordPress Actions plugin before version 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path. This allows authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0 in the /ajax_enroll.php file of the Enrollment Management component. Manipulation of the student_id, schedule_id, or action arguments leads to improper authorization, allowing unauthorized access.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0/1.php in the file /edit_course1.php. An unknown function allows manipulation of the ID argument, leading to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam1.php. An unknown function improperly handles the ID argument, allowing remote attackers to execute arbitrary SQL queries. The exploit has been published and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_room.php file. An attacker can remotely manipulate the ID argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /pay.php file via the Bankname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in code-projects Real State Services 1.0 in the /builderHome.php file. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been made public, increasing the risk of attacks.

AIL Framework has a path traversal vulnerability in its PDF object handling. The PDF.get_filepath() function constructs a file path by joining the configured PDF storage directory with a PDF object identifier without verifying the resolved path stays within the intended PDF_FOLDER directory. An authenticated attacker can use crafted identifiers with relative traversal sequences or absolute path components to open files outside the PDF directory, potentially disclosing sensitive data.