CVE Vulnerability Catalog

The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress (up to version 5.2.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An unauthenticated attacker could perform actions they are not authorized to do.

Apache ActiveMQ Client, Broker, All, and Web contain an improper validation and restriction of a classpath path name vulnerability. An authenticated user-provided 'key' value could be constructed to traverse the classpath due to path concatenation, exposing the application to a classpath resource loading vulnerability that could be chained with other attacks.

The Popup Box WordPress plugin before version 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform CSRF attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.

In Modem, there is a possible system crash due to a logic error, which could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction needed.

SQL Injection vulnerability in itsourcecode Construction Management System 1.0. An unknown function in /borrowedtool.php allows manipulation of the code argument, leading to SQL injection. Remote attack possible. Exploit published.

IBM Concert versions 1.0.0 through 2.2.0 creates temporary files with predictable names. A local user can exploit a symlink attack to overwrite arbitrary files.

In code-projects Online Hotel Booking 1.0, the file /booknow.php is vulnerable to XSS via the roomname parameter. The attack can be launched remotely and the exploit is publicly available.

WeGIA prior to version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter taken from the GET request is not validated or whitelisted, then used directly in a Location header. An attacker can redirect users to a malicious site.

WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.

WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.

Code Extension Marketplace prior to version 2.4.2 has a Zip Slip vulnerability allowing a malicious VSIX file to write arbitrary files outside the extension directory.

In WWBN AVideo versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Other endpoints in the CloneSite directory require admin privileges. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

In WWBN AVideo versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. Other FFmpeg management endpoints require admin privileges.

In WWBN AVideo versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

Directus before version 11.17.0 does not deduplicate resolver invocations in GraphQL queries. An authenticated user can exploit GraphQL aliasing to repeat expensive relational queries many times, causing database overload and server resource exhaustion.

In Directus before version 11.16.1, despite disabling GraphQL introspection (GRAPHQL_INTROSPECTION=false), the server_specs_graphql resolver on the /graphql/system endpoint still returned the schema in SDL format. This allowed bypassing the introspection control and exposing database structure (collection names, field names, types, and relationships) to unauthenticated users at the public level and to authenticated users at their permission level.

Directus prior to version 11.16.1 is vulnerable to an open redirect via the 'redirect' parameter on the /admin/tfa-setup page. An administrator who has not configured 2FA yet, after visiting a crafted URL and completing the 2FA setup, is redirected to an attacker-controlled external domain without any validation.

Directus prior to version 11.16.1 contains an open redirect vulnerability in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication.

The Open edX Platform before commit 76462f1e5fa9b37d2621ad7ad19514b403908970 contains an open redirect vulnerability in the view_survey endpoint. The redirect_url parameter is not validated, allowing attackers to redirect authenticated users to malicious sites and perform phishing and credential theft.

OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability. Unauthenticated attackers can submit malicious User-Agent headers to the /ocsinventory endpoint, which are stored without sanitization and rendered in the web console, leading to arbitrary JavaScript execution in authenticated users' browsers.