CVE Vulnerability Catalog

The RexCoin plugin in versions up to and including 1.2.6 contains an unauthenticated PHP Object Injection vulnerability.

The Document Library Lite WordPress plugin in versions up to 1.3.0 allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The issue affects versions from n/a through 1.3.0.

The YayMail WordPress plugin in versions up to 4.4.6 contains a PHP Object Injection vulnerability exploitable by a shop manager user. This can lead to injection of a malicious PHP object and further exploitation.

The Kirki WordPress plugin in versions up to 6.4.0 contains an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability that allows code injection. The issue affects versions from n/a through 6.4.0.

The WP Crowdfunding WordPress plugin in versions up to 2.2.2 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script that executes in the user's browser.

The LearnPress WordPress plugin in versions up to 4.4.10 contains a Broken Access Control vulnerability accessible to subscriber-level users. It allows performing actions beyond the granted permissions.

The Eventer WordPress plugin in versions up to 0.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the victim's browser.

Microsoft Edge (Chromium-based) contains an improper restriction of rendered UI layers or frames vulnerability. It allows an unauthorized attacker to perform spoofing over a network.

IBM Langflow OSS versions 1.0.0 through 1.12.4 allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because file-upload handling does not validate the destination path before writing to disk. An authenticated attacker can upload crafted files outside the intended storage directory to achieve remote code execution on the server.

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a Server-Side Template Injection (SSTI) vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker with a common operational role can inject template expressions that the server evaluates in an unrestricted context.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.