CVE Vulnerability Catalog

Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.

Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.

Permission verification bypass vulnerability in the Camera app. Successful exploitation may affect service confidentiality.

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to, and including, 1.0.334 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.

A permission control vulnerability in the Gallery module allows bypassing access controls. Successful exploitation may affect service confidentiality.

A SQL injection vulnerability was identified in CodeAstro Gym Management System 1.0 in the file /admin/equipment-entry.php. Manipulation of the ename argument leads to SQL injection, and the attack can be launched remotely. The exploit has been made publicly available and could be used.

A vulnerability has been found in the Drupal Owl Carousel 2 module. The issue affects all versions of the module (denoted as *.*).

A vulnerability has been found in the Drupal API Key manager module. The issue affects all versions of the module (denoted as *.*).

Vulnerability in Drupal Synchronize composer.Json With Contrib Modules. This issue affects Synchronize composer.Json With Contrib Modules: *.*.

A vulnerability in Drupal Protected Pages allows brute force attacks due to improper restriction of excessive authentication attempts. Affected versions are from 0.0.0 before 1.8.0 and from 7.X-1.0 before 7.X-2.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS). This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

A missing authorization vulnerability in Drupal Facets allows Forceful Browsing. This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Poppler, a PDF rendering library, contains a use-after-free (write) vulnerability in the StructTreeRoot class in versions prior to 25.10.0. The issue arises from using raw pointers to std::vector elements, which become dangling pointers when the vector is resized. Version 25.10.0 contains a patch.

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks. An attacker can manipulate the Host header to influence application behavior.

Infinite loop in the MONGO dissector in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service. This can cause Wireshark to hang or crash when processing malicious MONGO traffic.

python-ldap is an LDAP client API for Python. Prior to version 3.4.5, ldap.dn.escape_dn_chars() incorrectly escapes \x00 by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00, which can cause client-side denial of service.

In python-ldap versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted list or dict is supplied as the `assertion_value` parameter and the non-default `escape_mode=1` is configured. `escape_mode=0` (default) and `escape_mode=2` raise exceptions for such input, but `escape_mode=1` computes without adequate logic to ensure a fully escaped return value. If an application relies on this method to escape untrusted user input, an attacker might launch LDAP injection attacks, potentially disclosing or manipulating LDAP data.

A SQL injection vulnerability was discovered in Gym Management System 1.0 in /admin/user-payment.php. Manipulation of the plan argument allows remote SQL injection. The exploit is public.

A SQL injection vulnerability was identified in CodeAstro Gym Management System 1.0 in the file /customer/index.php. Manipulation of the fullname argument leads to SQL injection, and the attack can be performed remotely. The exploit is publicly available and might be used.