CVE Vulnerability Catalog

The Beaver Builder Plugin (Starter Version) for WordPress is vulnerable to Stored Cross-Site Scripting via the 'auto_play' parameter in all versions up to and including 2.9.2.1 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchat_handle_chat_request AJAX action.

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

An open redirection vulnerability exists in MOLGENIS EMX2 v11.14.0. An attacker can create a malicious URL using a manipulated redirection parameter, potentially leading users to phishing sites or other malicious destinations.

A Path Traversal vulnerability exists in TESI Gandia Integra Total version 4.4.2236.1. An authenticated attacker can download a ZIP file containing server files, including those in parent directories, by exploiting the "direstudio" parameter in comprimir.php.

Energy CRM v2025 by Status Tracker Ltd contains a Stored Cross-Site Scripting (XSS) vulnerability due to lack of proper validation of user input by sending a POST request to '/crm/create_job_submit.php' using the 'JobCreatedBy' parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed on every page. By default admin user is not able to add JavaScript into the website.

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

W podatności CVE-2025-10727 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w oprogramowaniu AcBakImzala firmy ArkSigner Software and Hardware Inc., co pozwala na ataki typu Reflected XSS. Problem dotyczy wersji AcBakImzala przed 5.1.4.

Multiple NAS management applications from I-O DATA DEVICE register Windows services with unquoted file paths. A user with write permission on the system drive root may execute arbitrary code with SYSTEM privilege.

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user logged into the affected product accesses a crafted URL, an arbitrary script may be executed in the user's web browser.

Slack Nebula before 1.9.7 mishandles CIDR in some configurations, thus accepting arbitrary source IP addresses within the Nebula network. This may allow unauthorized network access.

Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specific signing key while in use, allowing them to deploy a compromised or counterfeit device on that site. This issue affects Command Centre Server: 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), 9.00 prior to vEL9.00.3831 (MR8), all versions of 8.90 and prior.

Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 (MR2), 9.20 prior to vEL9.20.2819 (MR4), 9.10 prior to vEL9.10.3672 (MR7), all versions of 9.00 and prior.

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 (MR1), 9.20.2337 (MR3), 9.10.3194 (MR6).

Sakai, a Collaboration and Learning Environment, prior to versions 23.5 and 25.0, initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non-cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at-rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.

Authlib is a Python library for building OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib's JWE zip=DEF path performs unbounded DEFLATE decompression, allowing an attacker to exhaust memory and CPU and cause denial of service.

OpenBao is a secrets management system. Prior to version 2.4.2, the audit log did not properly redact fields when subsystems sent []byte parameters instead of strings. This includes sys/raw with encoding=base64 and Transit signing with Ed25519 keys, causing data exposure in audit logs. The issue is fixed in 2.4.2.