CVE Vulnerability Catalog

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.

A vulnerability was found in InstantSoft icms2 up to version 2.18.2. The index function in templates/default/controllers/messages/index.tpl.php of the Private Message Handler component is affected, and manipulation of the nickname argument leads to cross-site scripting. The attack can be launched remotely, and the exploit has been publicly disclosed. The patch is named 3a1ec8fcb073a46d06a2ab83bc2bf68225834281.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.

The Squadeno WordPress plugin before version 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer role to change the section, age group, author, password, comment settings and date of a sport they are assigned to.

The Envira Gallery WordPress plugin before version 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.

The Envira Gallery WordPress plugin before version 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.

The Envira Gallery WordPress plugin before version 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.

ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.

The SpeedyCache plugin for WordPress up to version 1.4.2 is vulnerable to sensitive information exposure via the 'comment_author_*' parameter. Unauthenticated attackers can extract full names and email addresses of commenters, which are pre-filled in forms and persisted in cached pages.

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.

The AI Puffer plugin for WordPress up to version 2.4.89 is vulnerable to authorization bypass. Authenticated attackers with subscriber-level access can modify global semantic search settings that are restricted to administrators.

The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. An authenticated attacker with subscriber-level access or above can modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), affecting all users of the plugin. This is only exploitable when an administrator has granted 'sources' module access to a lower-privileged role via the plugin's Role Manager.

Contao from version 4.0.0 to 5.3.50 and 5.7.12 has a CSRF vulnerability because RequestTokenListener validates the token only for POST requests, and the GET guard runs only when an act parameter is present. Backend actions via the key parameter can execute without a CSRF token when an authenticated user loads a malicious URL. Fixed in versions 5.3.50 and 5.7.12.

The illumos IP management daemon (ipmgmtd) lacks an authorization check, allowing a local user to change the persistent IPMP configuration. The IPMGMT_CMD_IPMP_UPDATE command does not require the solaris.network.interface.config authorization, and its handler writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged user can add or remove interfaces from existing IPMP groups in the stored configuration, potentially disrupting network connectivity when the configuration is next applied.