CVE Vulnerability Catalog

WWBN AVideo versions 26.0 and prior have a vulnerability in the endpoint plugin/YPTWallet/view/users.json.php, which returns personal information and wallet balances of all users to any authenticated user. There is no admin privilege check.

Admidio prior to version 5.0.8 contains a CSRF vulnerability in the registration module. Approval actions for pending registrations (create_user, assign_member, assign_user) are performed via GET requests without CSRF token validation, allowing an attacker to auto-approve their own registration by tricking an administrator with appropriate rights.

Admidio before version 5.0.8 contains a vulnerability in the inventory module where the item_save endpoint accepts a user-controllable POST parameter imported that, when set to true, completely bypasses CSRF token validation and server-side form validation. An authenticated user can craft a direct POST request to save arbitrary inventory item data without CSRF protection and without the field value checks that the FormPresenter validation normally enforces.

Admidio before version 5.0.8 does not validate a CSRF token in the delete mode handler in mylist_function.php. An attacker can trick an authenticated user into visiting a malicious page, leading to permanent deletion of list configurations, including organization-wide shared lists if the victim has administrator rights.

Parse Server prior to versions 8.6.63 and 9.7.0-alpha.7 returns unsanitized authentication data from the verify password endpoint, including MFA TOTP secrets, recovery codes, and OAuth tokens. An attacker who knows the user's password can extract the MFA secret and generate valid MFA codes.

Captcha Protect, a Traefik middleware, is vulnerable to reflected XSS. The challenge page accepts a client-supplied destination value and renders it into HTML using Go's text/template, which does not perform contextual HTML escaping.

In the Video player Play All Videos v1.0.135 by RAREPROB SOLUTIONS PRIVATE LIMITED, an arbitrary file overwrite vulnerability exists during the file import process. An attacker can overwrite critical internal files, leading to arbitrary code execution or information disclosure.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

In SourceCodester Loan Management System v1.0, there is a business logic vulnerability due to missing server-side validation. An authenticated attacker can bypass frontend restrictions and submit a negative value for the interest_percentage field, creating loan plans with negative interest rates.

Simple Gym Management System 1.0 is vulnerable to SQL Injection in the Payment Handler component. Parameters Payment_id, Amount, customer_id, payment_type, and customer_name are susceptible to manipulation.

An authorization bypass in Discourse's Category Chatables controller allows moderators to get information about hidden groups and user counts.

Discourse has a vulnerability in the group email settings test endpoint that allows initiating outbound connections to arbitrary hosts and ports. The endpoint was accessible to non-staff group owners.

Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allow a user to purchase a lower tier subscription but gain benefits associated with a higher tier subscription.

Discourse with the discourse-subscriptions plugin from versions 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 leaks Stripe API keys across sites in a multisite cluster, potentially exposing Stripe-related information across sites.

Discourse allows an authenticated user to obtain shared draft topic titles by sending an inline onebox request with a matching category_id.

Discourse allows non-staff users to access read receipt information for staff-only posts. Metadata (who read and when) is exposed, but not post content.

Discourse versions before 2026.1.3, 2026.2.2, and 2026.3.0 allow users who lost access to a topic to still interact with polls, including voting and toggling status.

Discourse allows inference of chat channel membership from user search without proper authorization.

In the Discourse discussion platform, versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allowed category group moderators to perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

In Discourse, when the hidden 'prioritize_full_name_in_ux' setting is enabled, user and group display names are rendered without HTML escaping in several assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic.