CVE Vulnerability Catalog

The Wallet System for WooCommerce plugin version 2.7.6 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to perform operations they should not be authorized for.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in BEAR versions 1.1.8 and earlier. It allows a remote attacker to inject malicious JavaScript code into the page without requiring authentication.

phpUploader before version 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.

The Home Assistant iOS companion app ignores the SSID allowlist for internal networks. When no other URL is found, it falls back to the internal URL, potentially exposing the user's token on an unsecured network.

A vulnerability in Claude Code (versions 2.1.38 through 2.1.163) allows worktree manipulation attacks, including creating worktrees named ".git" and navigating outside the sandbox. An attacker can overwrite files in the user's home directory (e.g., .zshenv), leading to code execution outside seatbelt sandbox restrictions.

The Helix3 plugin for Joomla! exposes an AJAX handler task that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files, and update template parameters.

A symlink traversal vulnerability was found in the getfattr and setfattr utilities of the attr package before version 2.6.0. A local attacker can replace a pathname component with a symbolic link during directory hierarchy traversal, leading to privilege escalation.

A vulnerability in the ACL library before version 2.4.0 allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. The libacl pathname-based functions are vulnerable to symlink traversal attacks.

FrontAccounting before version 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler. Authenticated attackers with SA_GLANALYTIC permission can inject malicious code into PARAM_2 and PARAM_3 POST parameters to execute arbitrary SQL queries.

FrontAccounting before version 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler. An authenticated attacker can inject UNION SELECT payloads into the PARAM_0 POST parameter, extracting arbitrary database data including usernames, password hashes, and email addresses, which are then rendered into PDF report output.

A path traversal vulnerability in FrontAccounting before version 2.4.20 allows authenticated attackers to achieve remote code execution by uploading files with traversal sequences in the unique_name parameter. Attackers can write a PHP file outside the attachments directory into the web root, leading to arbitrary code execution.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This causes discrepancies between fast-uri and Node's native URL parser, potentially bypassing host-based policies.

A vulnerability has been found in SourceCodester Inventory Management System 1.0 in the file /api/users_handler.php of the User Registration Endpoint. Manipulation of the role argument leads to improper access controls, allowing remote exploitation.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /preview3.php file. An attacker can remotely manipulate the course_year_section argument, leading to SQL injection. The exploit is publicly available.

In SourceCodester Class and Exam Timetabling System 1.0, the file /edit_class1.php is vulnerable to SQL injection via the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability in SzafirHost allows an attacker to inject a malicious native library into a JAR archive that is signed and verified. The signature verification uses a JarFile parser (reading the Central Directory), while extraction uses a JarInputStream parser (reading sequentially from local file headers). An attacker can insert a library entry between the last legitimate entry and the Central Directory, which is not seen by the signature verifier but is read and written by the extractor, leading to remote code execution.

A flaw was found in the vscode-java extension for Visual Studio Code, where it incorrectly trusts all Markdown content in JavaDoc hovers. A malicious Java file can include hidden commands, and if a user clicks a specially crafted link in a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands.

Multiple stack-based buffer overflows were discovered in the xmlcatalog utility of libxml2 when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. Supplying an overly long input line can overflow internal buffers (command, arg, and argv) during input parsing.

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and trigger an out-of-bounds read in the LZH decoder.