CVE Vulnerability Catalog

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce allows Stored XSS. This issue affects WPC Countdown Timer for WooCommerce from n/a through <= 3.1.4.

The MDTF plugin up to version 1.3.3.9 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.

The WPComplete plugin has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Affects versions up to and including 2.9.5.3.

The ZoloBlocks plugin up to version 2.3.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.

Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.

The Hydra Booking plugin for Themefic has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.1.9.

The DELUCKS SEO WordPress plugin (versions up to 2.5.9) has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This may allow unauthorized actions.

The Captcha.eu plugin (versions up to 1.0.61) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force server-side requests to arbitrary resources.

The Evergreen Content Poster WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.4.5. This may allow an attacker to force unintended actions on behalf of an authenticated user.

The Code Amp Search & Filter plugin (search-filter) up to version 1.2.17 is vulnerable to Cross-Site Request Forgery (CSRF).

The Custom CSS plugin for WordPress up to version 1.4.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Survey Maker plugin (versions up to and including 5.1.8.8) contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. Malicious scripts can be stored and executed by users.

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when directory listing is enabled, file and directory names are inserted into generated HTML without proper escaping in href, title, and link attributes. An attacker who can create or rename files in a served path can trigger stored XSS.

A vulnerability in LibreChat version 0.7.9 allows HTML injection via the Accept-Language header. A logged-in user can send a crafted GET request, leading to arbitrary HTML injection into the <html lang=""> tag of the response, potentially enabling XSS attacks.

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping.

In version 1.6.0 of the langgenius/dify-web application, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. When a login or registration attempt is made with a non-existent username or email, the system responds with a message such as "account not found," while an existing username or email with an incorrect password returns a different error message.

NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets, and 1.24.2 adds further scrubbing for YXDOMAIN and non-referral nodata replies.

The All in One Time Clock Lite plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers with subscriber access and above to clock other users in and out.

Connection desynchronization occurs between an HTTP proxy and the model backend. Fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action.

The Ghost Robotics Vision 60 robot version v0.27.2 includes physical interfaces such as three RJ45 connectors and a USB Type-C port, which lack authentication mechanisms when establishing connections. The robot's internal router automatically assigns IP addresses to any physically connected device, and the robot runs on ROS 2 without authentication by default.