CVE Vulnerability Catalog

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The handler emits the id value into an unquoted HTML attribute; esc_attr() does not encode spaces, allowing injection of additional HTML attributes including JavaScript event handlers. Authenticated attackers with Contributor-level access and above can inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.

A flaw has been found in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) affecting the file App/Home/Controller/VoteController.class.php of the Vote Handler component. Manipulation of the X-Requested-With argument causes business logic errors. Remote exploitation is possible, and the exploit has been published and may be used.

A vulnerability was detected in light0011 cms (versions c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) affecting the file_exists function in Public/Home/js/uploadify/check-exists.php of the Uploadify component. Manipulation of the filename argument results in file and directory information exposure. The attack may be launched remotely, and the exploit is now public and may be used.

In Gitea, seven API routes under /api/v1/users/{username} (followers, following, following/{target}, starred, subscriptions, keys, and gpg_keys) were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could read the followers, following list, starred and watched repositories, and public SSH and GPG keys of a user with limited or private visibility. The issue was fixed in 1.27.3 and 28.0.0 and disclosed with 28.2.0.

Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to a repository's releases, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size, and download count of the attachment through the release and allowed the user to rename or delete it.

The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was fixed in 28.1.0 and disclosed with 28.2.0.

Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.

GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description, clone URLs, owner and counters. The issue was fixed in 1.27.0 and 28.0.0 and disclosed with 28.2.0.

The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction of the lock. Only reactions were affected; no content could be changed.

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

Requesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the fix returns 404 for individual users.

The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a signed-in victim who opened a crafted link, and the attacker could then sign in as the victim through OpenID login, which does not apply the local TOTP or WebAuthn checks. The callback now requires a time-limited `state` value bound to the user.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The issue affects the Exam::startExam function in exam.php of the Exam Module component, where manipulation of the topicid argument results in SQL injection. The attack can be executed remotely and the exploit is now public.

A security vulnerability has been detected in WongKinYiu yolov9 0.1 in the DetectMultiBackend.__init__ function of models/common.py, related to the ONNX Metadata Handler. Manipulation of the names/stride arguments leads to code injection, and the exploit has been publicly disclosed.

A security flaw has been discovered in dyad-sh dyad up to 1.16.0 in the OAuth Callback Handler component, enabling cross-site request forgery. The issue is fixed in version 1.17.0-beta.1.

@fastify/jwt versions prior to 10.2.5 have top-level sign and verify methods that replace globally configured defaults with per-call options instead of merging them. This silently drops temporal protections such as token expiration and maximum accepted token age, so tokens never expire.

A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1 in the read_metadata_from_safetensors function of modules/sd_models.py, related to the Extra-Networks Card Builder component. Manipulation of the __metadata__.sshs_model_hash argument leads to cross site scripting, and the exploit is publicly available.

libstrophe through 0.14.0 contains a stack-based buffer overflow in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes.

lwIP through 2.2.1 contains a stack out-of-bounds write in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below 6.

librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes.