CVE Vulnerability Catalog

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.

The SEO Flow by LupsOnline WordPress plugin before version 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the plugin and take over the site. Exploitation requires the plugin to have been configured, which is its normal operating state.

The Hummingbird plugin for WordPress (versions up to and including 3.21.0) is vulnerable to Remote Code Execution via the log_msg() function in class-page-cache.php. The protective '<?php die(); ?>' header is omitted due to a class_exists() namespace bug, and cookie names with the wphb_cache_ prefix are written to the log file without sanitization, allowing an unauthenticated attacker to write and execute arbitrary PHP.

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0. This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

YesWiki prior to version 4.6.6 has a vulnerability in the {{erasespamedcomments}} wiki action that deletes arbitrary wiki pages without authorization based on a suppr[] array from POST. The default ACL model allows any user with write access to delete pages, including the front page and admin pages.

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user.

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path.

The MQTT service in Trueview 6.0.23.4 has no authentication. The MQTT broker accepts client connections on TCP port 1883 without requiring authentication, allowing a remote attacker with network access to establish an MQTT session and perform unauthorized publish or subscribe operations.

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component.

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components.

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

PJSIP prior to commit c4a151a has a stack buffer overflow in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value can cause an oversized entry to be written past the end of a fixed-size stack buffer.

PJSIP prior to commit a1b707c has a stack buffer overflow in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer. An excessive number of attributes can cause a write past the end of a fixed-size array on the stack.

A vulnerability in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO devices allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (adbd).

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port, allowing a remote attacker to execute arbitrary code.

In DocsGPT 0.15.0 and below, the custom prompt feature allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE).