CVE Vulnerability Catalog

W podatności CVE-2025-14347 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w systemie OBS (Student Affairs Information System)0, co pozwala na ataki typu Reflected XSS. Problem dotyczy wersji przed 26.5009.

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress (all versions up to 1.9.6) is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the download_plugin_bulk and download_theme_bulk functions. Unauthenticated attackers can archive all the site's plugins and themes and place them in the `wp-content/uploads/` directory via a forged request if they can trick a site administrator into performing an action such as clicking a link.

The Zephyr Project Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.203 via the `file` parameter. This makes it possible for authenticated attackers, with Custom-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. On servers that have `allow_url_fopen` enabled, this issue allows for Server-Side Request Forgery.

The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party apps which can construct intents to directly open adb debugging functionality without user interaction.

The WP Cookie Consent plugin for WordPress (all versions up to 4.0.7) is vulnerable to unauthorized data modification due to a missing capability check on the gdpr_delete_policy_data function. Unauthenticated attackers can permanently delete arbitrary posts, pages, attachments, and other post types by ID.

The Converter for Media plugin for WordPress (all versions up to 6.3.2) is vulnerable to unauthorized data modification due to a missing capability check on the `/webp-converter/v1/regenerate-attachment` REST endpoint. Authenticated attackers with Subscriber-level access and above can delete optimized WebP/AVIF variants for arbitrary attachments.

Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings functions in all versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view and modify plugin's advanced settings.

Certain ASRock motherboard models and its subsidiaries have a protection mechanism failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.

Certain GIGABYTE motherboard models have a protection mechanism failure vulnerability. Because IOMMU was not properly enabled, unauthenticated physical attackers can use a DMA-capable PCIe device to read and write arbitrary physical memory before the OS kernel and its security features are loaded.

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can read all knowledge base entries. Users should upgrade to 10.0.21 to receive a patch.

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages.

nopCommerce version 4.90.0 is vulnerable to Cross-Site Scripting (XSS) via the Currencies functionality.

nopCommerce version 4.90.0 is vulnerable to Cross-Site Scripting (XSS) via the Blog posts functionality in the Content Management area.

nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Attributes functionality.

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework versions >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

AmpereOne AC03, AC04, and M devices allow an incorrectly formed SMC call to UEFI-MM Boot Error Record Table driver, potentially resulting in out-of-bounds read (leaking Secure-EL0 info) or out-of-bounds write (corrupting Secure or Non-Secure memory).

GLPI, a free asset and IT management software, versions 10.0.0 through 10.0.20 allow an unauthenticated user to store an XSS payload via the inventory endpoint.

The Dbit N300 T1 Pro router running firmware V1.0.0 lacks rate limiting on the /api/login endpoint, allowing attackers to brute force passwords.

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.