CVE Vulnerability Catalog

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots.

In Devolutions Server, an improper access control issue allows a View-only user to retrieve sensitive third-level nested fields, such as password list custom values, resulting in password disclosure. Affects versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier.

The Contest Gallery plugin by ContestGallery developer contains a Cross-Site Request Forgery vulnerability in versions from n/a through 28.0.0. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

The Effect Maker plugin by anibalwainstein contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Effect Maker from n/a through <= 1.2.1.

The UDesign Core plugin by AndonDesign contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects UDesign Core from n/a through <= 4.14.1.

The Cost Calculator Builder plugin (Stylemix) up to version 3.5.32 has a Missing Authorization vulnerability. This means unauthorized users may gain access to functions that should be protected.

The TheGem Demo Import (for WPBakery) plugin has a missing authorization vulnerability, allowing unauthorized users to access demo import functionality. Affects versions up to and including 5.10.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements. This issue affects TheGem Theme Elements (for WPBakery) from n/a through <= 5.10.5.1.

Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub. Allows retrieving embedded sensitive data. Affects versions up to and including 1.23.9.

Missing Authorization vulnerability in Togo by uxper. Affects versions before 1.0.4.

The Togo plugin (versions < 1.0.4) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may lead to unauthorized access to functions or data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through < 3.9.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.

Missing Authorization vulnerability in ThemeNectar Salient. This issue affects Salient from n/a through 17.4.0.

Missing Authorization vulnerability in hogash KALLYAS kallyas. This issue affects KALLYAS from n/a through <= 4.22.0.

The KALLYAS theme for WordPress is vulnerable to missing authorization in versions up to and including 4.22.0. This vulnerability may allow unauthorized access to functions or data.

The TheGem (Elementor) plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.

The TheGem plugin for WordPress is vulnerable to Cross-site Scripting up to version 5.10.5. This is due to improper neutralization of input during web page generation.

Missing Authorization vulnerability in Bux Woocommerce bux-woocommerce allows accessing functionality not properly constrained by ACLs. This issue affects Bux Woocommerce from n/a through <= 1.2.3.

Unrestricted upload of dangerous file types in Atarim visual collaboration plugin up to version 4.2.1. Allows using malicious files.