CVE Vulnerability Catalog

Cross-site request forgery vulnerability in OpenRefine up to version 3.10.1 in the get-rows command. Allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

Incorrect authorization vulnerability in SkillHub before version 0.2.22 in AccountMergeService and AccountMergeController. Allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode. When no webhook_secret is configured, remote attackers can send unauthenticated updates to port 8080 and spoof an allowed or admin user_id to run privileged commands like /shell on the host.

AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

WPAdverts by Greg Winiarski through version 2.3.4 contains a Reflected XSS vulnerability (improper input neutralization during web page generation). An attacker can exploit reflected XSS to execute malicious scripts in the victim's browser.

WPAdverts by Greg Winiarski through version 2.3.4 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

Tainacan through version 1.3.0 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

Slider by 10Web through version 1.2.62 contains a deserialization of untrusted data vulnerability that allows Object Injection. An attacker can exploit this to execute malicious code or manipulate application objects.

Forminator by WPMU DEV through version 1.57.3 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble after checking only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. This can cause a crash (denial of service) and could expose adjacent memory contents. Affects versions from 2.0.0-incubating before 5.3.0.

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The vulnerability is due to the endpoint's permission callback returning true unconditionally combined with insufficient validation of the input, allowing unauthenticated attackers to read arbitrary files on the server.

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name>' parameter in all versions up to and including 1.7.31 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, but this requires specific administrator configuration.

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to and including 44.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator visits the WPO365 wizard page, with the payload stored in the wpo365_errors transient for up to three days.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to and including 9.3.03.002 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when a user accesses an injected page, using a bypass that converts HTML entities back to live tags.

The Zeinet plugin by Bracketweb is vulnerable to Reflected XSS in versions up to and including 1.0.0 due to improper neutralization of input during web page generation.