CVE Vulnerability Catalog

The Ad Inserter plugin in versions up to 2.8.19 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.

The Forminator Forms plugin for WordPress in versions up to and including 1.57.3.1 is vulnerable to Insecure Direct Object Reference via the 'previous_draft_id' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress in versions up to and including 1.17.10 is vulnerable to stored cross-site scripting via inbound email body due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

A vulnerability in the GNU C Library (glibc) version 2.0 and later affects the gettext family of functions, which accept LANGUAGE environment variable entries containing '/' or equal to '..'. This allows an attacker to load a crafted message catalog (.mo file) from an arbitrary filesystem location, potentially crashing the program or executing arbitrary code with the program's privileges. The flaw is not covered by the earlier CVE-2014-0475 fix, which addressed other environment variables.

The NextGEN Gallery plugin for WordPress in versions up to and including 4.4.1 is vulnerable to remote code execution via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, where the extension check accepts sanitized .php_ filenames.

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch.

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user.

A flaw exists in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow.

Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single deeply nested request to WebMail, WebAdmin, or WebMail Proxy listeners to exhaust the stack and crash SMTP, IMAP, POP3, and web services repeatedly.

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then close the connection to terminate the proxy.

A vulnerability was found in cak-filemanagement-system in the move_uploaded_file function of admin/add_logs.php. Manipulating the File argument allows unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was found in cak-filemanagement-system in the mysqli_query function of admin/save_student.php. Manipulating the date/department/subject/forwarded_to/action_taken_by/section/password arguments results in SQL injection, and the attack can be carried out remotely. The exploit has been made public and could be used.

In JetBrains products (IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, DataSpell) before the versions specified in the description, the embedded browser trusted revoked intermediate certificates. This could lead to acceptance of invalid certificates.

The Essential Addons for Elementor plugin for WordPress up to 6.8.7 is vulnerable to privilege escalation via the page_id parameter of the register_user() function. An unauthenticated attacker can register an account with a role as high as Editor by abusing revision status and nonce bypass. Exploitation requires user registration enabled and an administrator having previously saved and reverted a non-default role on an affected page.

The Avada theme for WordPress up to 7.16.2 is vulnerable to arbitrary file upload via the convert_palette_images_to_truecolor() function. Insufficient file type validation before processing uploaded files allows unauthenticated attackers to upload executable files, enabling remote code execution.

The easy.jobs plugin for WordPress up to 2.8.4 is vulnerable to stored cross-site scripting via the 'cover_letter' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator opens the affected candidate's Application tab and clicks a crafted link.

The Advanced Custom Fields: Extended plugin for WordPress up to 0.9.2.7 is vulnerable to sensitive information exposure. An unauthenticated attacker can extract the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. This requires a public [acfe_form] shortcode page with a Term action using a save.name field mapping.

The Email Templates Customizer and Designer plugin for WordPress up to 1.5.14 is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate customer billing data (name, address, phone, email). Two unauthenticated requests are required.

The Ak Framework plugin for WordPress (included in the Newsy theme) up to 2.9.8 is vulnerable to privilege escalation due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers before passing attacker-controlled option names and values to update_option(). An unauthenticated attacker can update arbitrary WordPress options, including users_can_register and default_role, to gain administrator privileges.

The Independent Analytics Pro plugin for WordPress up to 2.15.5 is vulnerable to stored cross-site scripting via the 'utm_campaign' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires the Pro build to be active, and the attacker must first visit a frontend page to obtain a signed payload, then replay it with a crafted utm_campaign against the /iawp/search endpoint.