CVE Vulnerability Catalog

WordPress plugin admin-word-count-column 2.2 contains a local file read vulnerability allowing unauthenticated attackers to read arbitrary files by exploiting null byte injection in the path parameter. Attackers can send GET requests to download-csv.php with a crafted path parameter containing directory traversal sequences and null bytes to bypass file restrictions and read sensitive files like system configuration.

WordPress Plugin WP24 Domain Check 1.6.2 contains a stored XSS vulnerability. Authenticated attackers can inject malicious scripts via the fieldnameDomain parameter in the plugin settings form. Scripts execute in the browsers of administrators viewing the settings page.

WordPress Plugin Stripe Payments before 2.0.40 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the AcceptStripePayments-settings[currency_code] parameter. Attackers can submit POST requests to /wp-admin/options.php with script payloads in the currency_code field to execute arbitrary JavaScript in administrator browsers when settings are viewed.

WordPress Plugin WP-Paginate 2.1.3 contains a stored XSS vulnerability. Authenticated attackers can inject malicious scripts via the preset parameter in the plugin settings form. Scripts are stored and execute in administrator browsers when settings are viewed.

In jfinal_cms up to version 5.1.0, an SQL injection vulnerability was found in the list function of AdvicefeedbackController.java. Manipulating the orderBy argument allows remote attack. The project was notified but has not responded.

hsweb-framework up to version 5.0.1 contains a path traversal vulnerability in the denied function in FileUploadProperties.java. An attacker can remotely manipulate the filename argument to access files outside the intended directory.

jishenghua jshERP up to version 3.6 is vulnerable to Server-Side Request Forgery (SSRF) in the insertPlatformConfig function. Manipulating the platformValue argument allows remote attackers to make server-side requests.

In jishenghua jshERP up to version 3.6, the addAccountHeadAndDetail function in AccountHeadService.java is vulnerable to path traversal via the fileName argument, allowing a remote attacker to manipulate file paths.

A weakness in zilliztech deep-searcher up to version 0.0.2 in the CollectionRouter.invoke function allows improper access controls via manipulation of the kwargs argument, enabling remote attacks.

NousResearch hermes-agent up to version 0.12.0 is vulnerable to authorization bypass in the resolve_session_by_title function. Manipulating the Title argument allows remote attackers to bypass authorization.

A weakness was identified in JeeWMS up to version 141740afb2ba14d441c82a833d0a418d07ca2d69 in the Boot Actuator Endpoint component in file /base-boot/actuator. Manipulation leads to information disclosure. The attack can be executed remotely, and exploit is publicly available. The vendor did not respond.

A vulnerability has been determined in FoundationAgents MetaGPT up to version 0.8.2, allowing command injection in the check_cmd_exists function of metagpt/utils/common.py. The attack may be initiated remotely but requires high complexity. The exploit is publicly available, and the project has not responded.

Tiobon Employee Self-Service System up to version 7.2 has an SQL Injection vulnerability in /Blog/BlogSearch.aspx of the Login Endpoint component. Manipulation of the Keyword argument allows remote SQL injection. The exploit is public, and the vendor did not respond.

In GL.iNet GL-MT3000 firmware version 4.4.5, a command injection vulnerability was found in the LuCI JSON-RPC interface via the rpc_sys function in /cgi-bin/luci/rpc. The attack is remotely exploitable. The vendor fixed it in version 4.8.1.

A vulnerability was detected in GL.iNet GL-MT3000 up to version 4.4.5 allowing OS command injection via the realpath function in /rpc (Minidlna Service). The attack can be launched remotely. The vendor confirms that version 4.7 includes global protection against such attacks.

In GL.iNet GL-MT3000 firmware up to version 4.4.5, a command injection vulnerability was found in the MTK Backend component via the device argument in iwinfo_backend in iwinfo.so. The attack is remotely exploitable. The exploit is public.

An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in the canAccessIssue function of the /issues/ file in the Pull Request Handler component via manipulation of the issue argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.

An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in an unknown part of the file /repositories/{projectId}/default-branch in the REST API component via manipulation of the project.defaultBranch argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.

An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in an unknown functionality of the file /projects/ in the Parent Project Handler component via manipulation of the project.parentId argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.

An improper authorization vulnerability was detected in theonedev onedev up to version 15.0.5 in an unknown functionality of the file /projects via manipulation of the project.forkedFromId argument. The attack can be carried out remotely. The issue is fixed in version 15.0.6.