CVE Vulnerability Catalog

A vulnerability was found in a2ui up to 0.10.6 affecting the DataContext.resolveSignal function in data-context.ts of the Resolver component. The manipulation results in resource consumption and can be triggered remotely. The exploit has been publicly disclosed and a patch is available as c76e17272e52c12c6dcf68905b1df978c39e9aa5.

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'animated-text' shortcode. The atb_shortcode_handler() function fetches an arbitrary post by attacker-supplied ID and, without capability checks or post_type validation, displays its content, allowing authenticated attackers with Contributor-level access or higher to read rendered content of any published post, including non-public custom post types.

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in versions up to 1.4.05. Due to insufficient input sanitization and output escaping, an authenticated attacker with Subscriber-level access or higher can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the attacker to be assigned as a calendar owner.

The affiliate-toolkit plugin for WordPress is vulnerable to Arbitrary File Upload via the upload_image function. Due to insufficient file type validation (weak Content-Type prefix check and extension derivation from attacker-controlled URL path), an authenticated attacker with Contributor-level access or higher can upload executable files, enabling remote code execution. Exploitation requires the 'import product image' option to be enabled.

The AMP for WP – Accelerated Mobile Pages plugin for WordPress up to and including 1.1.17 is vulnerable to stored cross-site scripting via the 'headline-*' shortcode attribute due to insufficient input sanitization and output escaping. A Subscriber-level user can store a malicious shortcode in their biographical info field that executes when a user accesses the page.

The Pie Register Premium plugin for WordPress up to and including 3.8.4.0 is vulnerable to unrestricted file type upload via the piereg_file_upload function. File type validation errors are not checked before move_uploaded_file(), and the AJAX handler lacks nonce and capability checks, allowing unauthenticated attackers to upload PHP files and achieve remote code execution.

GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c. The flaw can lead to memory corruption when processing crafted VFAT filesystem data.

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers can inject headers or split OCSP requests sent to the responder host.

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI to inject HTTP headers or split requests sent to responders and proxies.

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

a2ui up to 0.10.6 contains a vulnerability in unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the Binder component, leading to resource consumption. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.

a2ui up to 0.10.6 contains a vulnerability in the DataModel.set function of the file renderers/web_core/src/v0_9/state/data-model.ts, leading to resource consumption. The attack can be launched remotely, and the exploit has been published and may be used.

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.