CVE Vulnerability Catalog

The Simple Membership WordPress plugin before version 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account. This allows unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

The SoftMarket — Digital Marketplace WordPress plugin through version 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow. This allows unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.

The Super Store Finder WordPress plugin before 7.11 fails to sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract database data.

The Webinfos WordPress plugin through version 1.2 does not validate the type or name of uploaded files, nor does it require authentication or a nonce check for the upload action. This allows unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.

In Bouncy Castle for Java before 1.85, a Stapled OCSP response is accepted without binding to the checked certificate. This issue also affects LTS before 2.73.12 and FIPS before 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).

In Bouncy Castle for Java before 1.85, Name Constraints can be bypassed via a trailing dot in rfc822Name and URI. This issue also affects LTS before 2.73.12 and FIPS before appropriate versions.

In Bouncy Castle for Java before 1.85, the MTI/A0 Diffie-Hellman key agreement exponentiates an unvalidated peer value. This issue also affects LTS before 2.73.12.

PyAthena prior to 3.35.4 contains a SQL injection vulnerability in DefaultParameterFormatter.format(). Unauthenticated attackers can inject arbitrary SQL by exploiting improper quote-escaping.

FreeRDP before 3.30.0 has a heap-based buffer overflow in CliprdrStream_Read. A malicious RDP server can send an oversized response, causing an out-of-bounds write.

The POUCO Import Users WordPress plugin through version 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value. This allows unauthenticated attackers to create a new administrator account and take over the site.

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. The Apple login handler accepts the Apple id_token and decodes only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims. Additionally, the security nonce required to invoke the login flow is publicly exposed to unauthenticated users via a localized JavaScript object on the login page.

ArcadeDB before version 26.7.2 contains an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Attackers can access and modify databases without proper permissions by directly calling affected endpoints with arbitrary database parameters.

ArcadeDB before version 26.7.2 fails to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

The @better-auth/scim plugin versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

Wazuh workflows before commit 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

FreeRDP before version 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

FreeRDP before version 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

The Single Sign On For TNG plugin for WordPress is vulnerable to authentication bypass via unauthenticated password reset. The `ssoprocess_ajax()` function accepts an `email` parameter and calls `reset_password()` without any ownership token or email confirmation. The only guard is a nonce that is publicly broadcast on every page, allowing an attacker to capture it and change any account's password, including administrator accounts.

The Participants Database WordPress plugin before version 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.