CVE Vulnerability Catalog

An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates (contract_terms) using frappe.render_template() with a user-supplied context (doc). Although Frappe uses a custom SandboxedEnvironment, several dangerous globals such as frappe.db.sql are still available in the execution context via get_safe_globals(). An authenticated attacker with access to create or modify a Contract Template can inject arbitrary Jinja expressions into the contract_terms field, resulting in server-side code execution within a restricted but still unsafe context. This vulnerability can be used to leak database information.

TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter. An attacker can supply malicious data in this parameter to execute arbitrary system commands.

TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command injection in setOpModeCfg via hostName. An attacker can exploit this parameter to execute arbitrary system commands.

A vulnerability in Hitron HI3120 version 7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in index.html.

grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page.

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 4.3.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to and including 2.13.3. Authenticated attackers with Author-level access and above can add images to arbitrary Modula galleries owned by other users.

The OneSignal – Web Push Notifications plugin for WordPress up to version 3.6.1 is vulnerable to unauthorized data modification due to missing capability check on settings handling. Unauthenticated attackers can overwrite OneSignal App ID, REST API key, and notification behavior via direct POST requests.

The FluentAuth – The Ultimate Authorization & Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to and including 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor level access and above to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The CC Child Pages plugin for WordPress up to version 2.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the 'child_pages' shortcode. This is due to insufficient input sanitization and output escaping on four user-supplied attributes in the 'show_child_pages' function.

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress (all versions up to and including 4.4.6) is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes due to insufficient input sanitization and output escaping. An authenticated attacker with contributor level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to and including 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user-controlled key. This allows authenticated attackers with author level access and above to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.

An issue was discovered in Wekan (open source kanban board system) up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.

In allauth-django before version 65.13.0, both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead.

In allauth-django before version 65.13.0, marking a user as is_active=False after tokens had been issued while the account was still active had no effect. This was fixed so that access and refresh tokens are now rejected.

A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users are recommended to upgrade to version 3.1.4.

The vulnerability is due to improper neutralization of input during web page generation (Cross-site Scripting, CWE-79). An authenticated user can render HTML tags within a user's browser via the integration package upload functionality.

Improper authentication in the Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. An attacker would need such a certificate signed by a trusted CA.

An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. By executing the bundled interpreter directly the attacker's scripts run with the application's TCC privileges. In fixed versions parent-constraints are used to allow only the main application to launch interpreter with those permissions. This issue affects LibreOffice on macOS: from 25.2 before < 25.2.4.