CVE Vulnerability Catalog

The Location Weather plugin for WordPress up to version 3.0.2 is vulnerable to unauthorized data modification due to missing capability checks in the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions, allowing authenticated attackers with Contributor-level access or above to disable all weather blocks and purge all weather cache transients.

The CBX 5 Star Rating & Review plugin for WordPress versions up to 1.0.7 is vulnerable to Reflected XSS via the 'page' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if an administrator clicks a link.

The Alfie – Feed Plugin for WordPress up to version 1.2.1 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the alfie_manage() function handling feed deletion via the 'delete' GET parameter. Unauthenticated attackers can delete arbitrary plugin feed data by tricking an administrator into clicking a link.

An information disclosure vulnerability was found in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.

The WP Blockade plugin for WordPress up to version 0.9.14 is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in the render_shortcode_preview() function, due to insufficient input sanitization and output escaping. The endpoint requires authentication (Subscriber-level or above) and lacks nonce verification or capability checks.

The FastX theme for WordPress up to version 1.0.2 lacks capability checks in the 'ultp_install_callback' and 'ultp_activate_callback' functions, allowing authenticated attackers with subscriber-level access to install and activate the PostX plugin.

In Mothra, the software respects a default value given by a website for HTML file upload forms. An attacker can craft a website with a malicious default file path and conceal this form element.

For certain crafted inputs, an ed25519.PrivateKey was created by casting malformed wire bytes, leading to a panic when used.

SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can panic when a client presents a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

In SSH, when an authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded. This could drop certificate restrictions like force-command after a second factor. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

An authenticated SSH client that repeatedly opened channels rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Concrete CMS 9 before version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the approveVersion() controller. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an administrator.

IDOR vulnerability in Concrete CMS 9.5.0 and below allows unauthenticated attackers to vote in restricted surveys via a public endpoint.

Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking.

Concrete CMS version 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. The pagination function directly interpolates the $URL field into the href attribute, allowing an authenticated admin or report viewer to execute JavaScript by clicking a crafted link.

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated page metadata disclosure across every page with a configured summary template, revealing the existence of private, draft, and restricted pages while leaking title, path, description, and author information.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/get_rating' endpoint confirms existence and returns rating score for any message by ID.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_page' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/ccm/frontend/conversations/message_detail' endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and the moderation queue. File attachments with download URLs are also exposed.

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint '/ccm/system/dialogs/file/usage/{fID}' accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.