CVE Vulnerability Catalog

In Daptin (a GraphQL/JSON-API headless CMS) before 0.12.26, the global LanguageMiddleware passes the raw Accept-Language header to golang.org/x/text without a size or shape filter. The guard for CVE-2022-32149 counts hyphens but not underscores, so long lists of underscore-separated language subtags bypass it and cause quadratic buffer processing. Unauthenticated requests to the public landing page or /api can exhaust server CPU.

In VoiceSentinel (a real-time voice moderation system for Minecraft servers) versions 2.2.1 through 3.3.0, the optional report buffer feature has a race between retention cleanup and transcript writes. _maybe_cleanup() uses an unlocked dictionary for hourly cleanup throttling, and _cleanup_tenant() rewrites transcripts.jsonl without file locking or atomic replacement while report_buffer_append_async appends without synchronization. With the report buffer enabled, racing writes can lose, duplicate, or corrupt transcript data and defeat retention pruning, leading to unbounded disk growth.

In Crass (a Ruby CSS parser compliant with CSS Syntax Level 3) before 1.0.7, scientific-notation number values are converted with unbounded exponentiation before clamping to Float::MAX. Applications parsing attacker-controlled CSS can be forced to spend disproportionate CPU and memory on a tiny input, potentially causing a crash.

In Copernik XML Factory (secure-by-default JAXP factory creation for Java) before 0.1.2, XInclude resource resolution is not blocked on the stock JDK provider when an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). Parsing untrusted XML can disclose local files or, via http references, reach internal network endpoints through SSRF.

In AdminNeo (a PHP database management tool) versions 4.6.2 through 5.4.x, the unauthenticated ?script=version endpoint accepts POST data without origin, CSRF, or parameter-type validation. A version[] parameter becomes a PHP array that bootstrap.inc.php serializes into the shared adminneo.version cache, and design.inc.php later passes that value to cookie() and rawurlencode(), causing a TypeError. An attacker can make the instance return HTTP 500 to all users for the cache's 24-hour lifetime or until the poisoned cache is removed.

The Profile Builder plugin in versions up to 4.0.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The description does not specify the injection vector or vulnerable parameter.

The Fast Velocity Minify plugin in versions up to 3.5.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The description does not specify the injection vector or vulnerable parameter.

In OpenAM before 16.1.1, the RADIUS authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 Response Authenticator; the RFC 2869 Message-Authenticator is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success, so an attacker can race the real server or spray forged Access-Accept packets and obtain a session for any RADIUS-mapped username without knowing the shared secret.

The WordPress plugin BA Book Everything in versions up to 1.8.33 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The WordPress plugin WP EasyPay in versions up to 4.5.4 contains an unauthenticated Path Traversal vulnerability. An unauthenticated attacker can access files outside the intended directory.

The VikRentCar plugin (e4jvikwp) through version 1.4.10 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in a user's browser.

The WordPress plugin MasterStudy LMS in versions up to 3.7.55 contains a PHP Object Injection vulnerability exploitable by a subscriber-level user. This may lead to injection of a malicious PHP object.

The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.

The WordPress plugin WP BASE Booking in versions up to 6.5.2 contains a privilege escalation vulnerability exploitable by a subscriber-level user. This may lead to elevated privileges within the site.

The WordPress plugin WP REST Cache in versions up to 2026.3.1 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can access functions or data they should not be able to reach.

The WordPress plugin Flexible Chat in versions up to 1.1.0 contains an unauthenticated Sensitive Data Exposure vulnerability. An unauthenticated attacker can access information that should be protected.

The WordPress plugin eCommerce Product Catalog in versions up to 3.6.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The WordPress plugin Mang Board WP in versions up to 2.4.6 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The VikRentCar plugin in versions up to 1.4.9 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.

The HUSKY plugin in versions up to 1.4.6 contains an unauthenticated Broken Access Control vulnerability. An attacker can bypass access control mechanisms and perform unauthorized actions.