CVE Vulnerability Catalog

WildFly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker with access to the IIOP port may construct and send malicious objects to achieve deserialization, if the target EJB allows untyped method parameters and depending on available gadget chains in the classpath.

In nvm versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . and # but not backslash. A version string containing # closes the address early and the rest is parsed as sed commands, allowing shell command execution with GNU sed or file read/write with BSD sed.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side secrets such as authentication salts and database credentials.

A flaw was found in WildFly allowing a remote attacker to bypass authentication on IIOP EJB invocations. The CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, letting a pre-auth attacker on port 3528 impersonate any principal on every IIOP-exposed @Remote EJB.

The Two Factor Authentication WordPress plugin before 1.17.0 and All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.

The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through Output Buffer Regex Corruption in all versions up to and including 5.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages.

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_type' Cookie in all versions up to and including 1.5.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through the 'Remove Microdata' Output Filter in all versions up to and including 2.3.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to and including 3.8.1. The final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table only on attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state.

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in all versions up to and including 4.1.12 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to and including 1.26.1.20 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

The Wild Apricot Login plugin for WordPress in versions up to and including 1.0.18 is vulnerable to authentication bypass via SSO email-collision account binding. When no WildApricot contact-ID mapping is found, the plugin falls back to a network-global email lookup and issues a session cookie for the resolved user without requiring proof of account ownership (password, email verification, or admin approval). An attacker with a WildApricot contact whose email matches a WordPress subsite administrator's email can authenticate as that administrator across the Multisite network.

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the service or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.

Prior to 1.2.27, any authenticated MailWatch user, including the U, D, and H roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message id to mailscanner/quarantine_action.php. The action does not check message ownership or apply the per-role global_filter, and message identifiers are enumerable.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component. An authenticated user who can post in a channel visible to a system administrator can cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks.

An SSRF vulnerability in AVideo (before version 8.1.0) allows an unauthenticated remote attacker to read responses from internal HTTP/HTTPS and FTP services. The `url_get_contents` function does not reject private, loopback, or link-local addresses and disables TLS peer verification, while the `objects/login.json.php` endpoint returns the fetched body. Additionally, `view/youtubeDl.json.php` enables requests to internal FTP servers.

In AVideo before 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. The endpoints `view/run.php`, `view/queue.json.php`, `view/status.php`, and `view/listFiles.json.php` allow an unauthenticated attacker to drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in any directory readable by the web-server user. This is fixed in version 8.1.0.

In AVideo before 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. This is fixed in version 8.1.0.