CVE Vulnerability Catalog

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.

In the Linux kernel, xfrm iptfs fails to propagate the SKBFL_SHARED_FRAG flag when copying fragments in iptfs_skb_add_frags(). If the source SKB has shared fragments, the new inner SKB may be incorrectly treated as having private fragments, leading to writes to memory still referenced by the outer SKB. The fix sets the flag in the loop after each fragment addition.

Apache Lucy (all versions) contains a stack-based buffer overflow vulnerability. The project is retired, and a fix has been released in version 0.8.0 in the repository outside the ASF.

Apache Lucy (all versions) contains a deserialization of untrusted data vulnerability. The project is retired, and the offending feature has been removed in version 0.8.0 outside the ASF.

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.

The Ajax Load More WordPress plugin before version 8.0.1 fails to properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit OTP verification attempts or invalidate a one-time login code after a wrong guess. An unauthenticated user can request a login code for any account, and due to short numeric OTP, brute-force can lead to account takeover, including admin.

The Membership Plugin – Kadence Memberships for WordPress (up to version 4.0.0) is vulnerable to password reset link poisoning leading to account takeover. The legacy lost-password handler consumes the attacker-controlled rc_redirect parameter in two unvalidated sinks, allowing unauthenticated attackers to trigger password reset requests for any account (including administrators) and leak the reset key.

OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1 contains a buffer overflow in the construct_uri() function, which concatenates URI components into a fixed 1024-byte buffer without bounds checking. An attacker can control the username to overflow the buffer and overwrite adjacent global data, including the disable_503_translation flag, altering routing behavior.

OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check does not account for base64 expansion, allowing overflow of up to 21,844 bytes, overwriting adjacent transformation buffers.

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation. Attackers can use gadget chains such as SoapClient or Imagick for remote code execution.

In NASA cFS v7.0.1, the Executive Services dynamic application start path component has incorrect access control. An attacker can place a shared object on target storage, allowing arbitrary code execution.

Google::Auth for Perl before version 0.06 runs a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command and runs it as `system($command)`, passing the whole string to /bin/sh -c. No opt-in gate guards the call, and the path is reached from the standard Application Default Credentials flow.

OpenSIPS version 4.0.0 and prior contain a stack buffer overflow in sip_to_json() when a SIP header name exceeds 255 bytes. An attacker can send a single UDP packet to port 5060 to crash the process or potentially achieve remote code execution.

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation. Attackers can exploit the db_dbprefix value to break out of a PHP string literal and add their own code.

MaxSite CMS 109.5 and earlier contain an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path to any *-ajax.php file. This can enable manipulation of poll states and vote counts.