CVE Vulnerability Catalog

WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints.

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability. Static OAuth clientId and clientSecret values are embedded in JavaScript delivered to the frontend, such as in parameters.js, allowing unauthenticated attackers to recover them.

Pistache (a C++ REST toolkit) versions 0.0.5 through 0.4.26 use std::regex_replace() with the //+ expression to collapse consecutive slashes in SegmentTreeNode::sanitizeResource(). With libstdc++, a path with tens of thousands of consecutive slashes causes deep recursion, stack exhaustion, and process crash.

The Booktics plugin (Arraytics) through 1.0.31 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

The Unlimited Elements For Elementor plugin through 2.0.26 contains an improper control of filename for include/require statement in PHP (PHP Remote File Inclusion) vulnerability, allowing PHP Local File Inclusion.

The Divi Contact Form 7 plugin (cf7-styler-for-divi) through 4.1.0 contains an improper neutralization of script-related HTML tags in a web page (Basic XSS) vulnerability, allowing code injection.

The Fluent CRM plugin (WP ManageNinja LLC) through 3.2.6 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

The Event Tickets plugin (Liquid Web / StellarWP) through 5.30.2 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

The Unlimited Elements For Elementor plugin through 2.0.26 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

The BookIt plugin (Liquid Web / StellarWP) through 2.6.0.6 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

Crass (a Ruby CSS parser) prior to 1.0.7 inefficiently tracks positions of multi-byte characters when parsing input containing non-ASCII characters. This results in superlinear parsing time, and an attacker can supply CSS with many non-ASCII characters, causing excessive CPU consumption and potential denial of service.

Crass, a Ruby CSS parser, prior to 1.0.7, when the :preserve_comments option is disabled (the default), discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet with a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application.

Crass, a Ruby CSS parser, prior to 1.0.7 recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises a SystemStackError or cause excessive memory usage.

The Profile Builder plugin in versions up to 4.0.5 contains a privilege escalation vulnerability allowing a Contributor-role user to elevate privileges. This may grant access to functionality reserved for higher roles.

The Booking and Rental Manager plugin in versions up to 2.8.2 contains a Broken Access Control vulnerability allowing a Subscriber-role user to perform unauthorized actions. This may lead to bypassing access controls on plugin functionality.

The GIFTiT – Free Gifts for WooCommerce plugin in versions up to 4.5 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This may allow code injection into a web page.

The Ultimate Addons for Elementor - Lite plugin in versions up to 2.9.5 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This may allow persistent injection of malicious script.

The User Registration plugin in versions up to 5.3.0 contains a Cross Site Scripting (XSS) vulnerability allowing a Subscriber-role user to inject malicious script. This may lead to code execution in other users' browsers.

Nezha versions 2.0.0 before 2.4.0 contain a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats. An authenticated user can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

NodeBB versions 1.18.0 through 4.16.5 contain an authorization bypass vulnerability allowing unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.