CVE Vulnerability Catalog

A vulnerability in Weaviate OSS before 1.33.4. Lack of validation of the fileName field in transfer logic allows an attacker who can call GetFile while a shard is in 'Pause file activity' state and FileReplicationService is reachable to read arbitrary files accessible to the service process.

RuoYi versions 4.8.1 and earlier contain a stored XSS vulnerability in the /system/menu/edit endpoint. Although the endpoint is protected by an XSS filter, the protection can be bypassed, and because the menu is shared across all users, any user with menu modification permissions can impact all users.

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. The malicious script is stored on the server and executed in the user's browser.

jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads, which can then be accessed via static URLs by all users.

Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm) when issuing JWT tokens. An attacker can exploit this to perform offline brute-force attacks on the user's password using a captured JWT, or to forge identity tokens if the password is known, leading to complete account takeover.

A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the file /api/employees. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely, and the exploit has been made available to the public. This product takes the approach of rolling releases, and the vendor was contacted but did not respond. This vulnerability only affects products that are no longer supported by the maintainer.

Code injection using Electron Fuses in waveterm on macOS allows TCC bypass. This issue affects waveterm 0.12.2.

SolarEdge monitoring platform contains a Cross-Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt.

SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug commands.

The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 stores exported CSV files in a publicly accessible directory with predictable filenames. Unauthenticated attackers can access sensitive user data including emails, IP addresses, usernames, roles, and location data.

The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This allows unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request if they can trick a site administrator into clicking a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.

The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to and including 1.0.6. Authenticated attackers with Subscriber-level access and above can retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events Manager plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. Unauthenticated attackers can extract data from password-protected, private, or draft event locations.

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action, allowing unauthenticated attackers to delete locations via a forged request if they can trick a site administrator into clicking a link.

The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugin's Stripe payment options.

Apache Fineract through version 1.10.1 contains a weak password requirements vulnerability. The issue is fixed in version 1.11.0, and users are encouraged to upgrade to the latest release, version 1.13.0.

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to and including 6.3.3. Authenticated attackers with Subscriber-level access and above can duplicate arbitrary posts, including password protected or private ones.