CVE Vulnerability Catalog

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.

The MediaWiki WebAuthn extension contains a stored XSS vulnerability due to improper input neutralization during web page generation. The vulnerability affects versions 1.39, 1.43, and 1.44 of the extension.

The Restaurant Brands International (RBI) assistant platform as of 2025-09-06 does not implement access control for the bathroom rating interface. This means any user can access this interface without authorization.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders. This means access control can be easily bypassed.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides a JWT that can be used to call an API to return a signed AWS upload URL for any store's path.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users. The flaw involves improper sharing of personal information among logged-in users.

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an 'Anyone Can Join This Party' signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s textContent when copying button labels. This causes escaped HTML in system message content (such as citizen-share, citizen-view-history, citizen-view-edit, and nstab-talk) to be interpreted as HTML in the sticky header, allowing injection of arbitrary script by a user with the ability to edit interface messages.

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The Download function of the file /DeviceFileReport.do?Action=Download is affected. Manipulation of the FilePath argument results in path traversal. The attack may be initiated remotely and the exploit has been made public.

yt-grabber-tui version 1.0 contains a TOCTOU race condition (CWE-367) during creation of the default config.json file. An attacker with write access to the config directory can use a symbolic link to overwrite arbitrary files accessible to the process.

One of the APIs in BLU-IC2 and BLU-IC4 up to 1.19.5 returns an incorrect Content-Type header (text/html instead of application/json). This may allow injection of HTML/JavaScript into the response.

A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The Download function of the file /Service.do?Action=Download is affected. Manipulation of the Path argument leads to path traversal. The attack can be launched remotely and the exploit has been disclosed to the public.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the Query function in /DeviceState.do?Action=Query is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be initiated remotely, and the exploit is publicly available.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the Query function in /DeviceFault.do?Action=Query is vulnerable to SQL injection via manipulation of the sortField argument. The attack can be launched remotely, and the exploit is now public.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the Query function in /MemoryState.do?Action=Query is vulnerable to SQL injection via manipulation of the orderField argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A Stored XSS vulnerability in the chat component of CobbleStone Enterprise Contract Management Portal v22.4.0 allows a remote attacker to execute arbitrary code in the victim's browser. The vendor states this issue is present only in an obsolete, unsupported version no longer in circulation.

ThingsBoard versions prior to v4.2.1 allow an authenticated user to upload malicious SVG images via the Image Gallery, leading to stored XSS. The exploit can be triggered when any user accesses the public API endpoint or embeds the image in an iframe during widget creation. The vulnerability resides in ImageController, which fails to restrict JavaScript execution.

In Shenzhen Ruiming Technology Streamax Crocus 1.3.40, the queryLast function in /RepairRecord.do?Action=QueryLast is vulnerable to SQL injection via manipulation of the orderField argument. The attack may be performed remotely, and the exploit has been made public.