CVE Vulnerability Catalog

In OpenAM before 16.1.1, the RADIUS authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 Response Authenticator; the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so an attacker can race the real server or spray forged Access-Accept packets and obtain a session for any RADIUS-mapped username without knowing the shared secret.

The WordPress plugin BA Book Everything in versions up to 1.8.33 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The Ultimate Addons for Elementor - Lite plugin in versions up to 2.9.5 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This may allow persistent injection of malicious script.

The WordPress plugin FunnelKit Automations (wp-marketing-automations) up to version 3.8.6.1 contains a deserialization of untrusted data vulnerability that allows object injection. This may let an attacker perform dangerous operations.

The WordPress plugin WP EasyPay in versions up to 4.5.4 contains an unauthenticated Path Traversal vulnerability. An unauthenticated attacker can access files outside the intended directory.

The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.

The VikRentCar plugin (e4jvikwp) through version 1.4.10 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in a user's browser.

The User Registration plugin in versions up to 5.3.0 contains a Cross Site Scripting (XSS) vulnerability allowing a Subscriber-role user to inject malicious script. This may lead to code execution in other users' browsers.

Nezha versions 2.0.0 before 2.4.0 contain a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats. An authenticated user can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

NodeBB versions 1.18.0 through 4.16.5 contain an authorization bypass vulnerability allowing unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.

GStreamer's gst-plugins-base MicroDVD subtitle parser contains a NULL pointer dereference flaw. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.

In the H.264 video parser in gst-plugins-bad, when processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash.

The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

The WordPress plugin MasterStudy LMS in versions up to 3.7.55 contains a PHP Object Injection vulnerability exploitable by a subscriber-level user. This may lead to injection of a malicious PHP object.

The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.

The WordPress plugin WP BASE Booking in versions up to 6.5.2 contains a privilege escalation vulnerability exploitable by a subscriber-level user. This may lead to elevated privileges within the site.

The WordPress plugin WP REST Cache in versions up to 2026.3.1 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can access functions or data they should not be able to reach.