CVE Vulnerability Catalog

A vulnerability was determined in kishor-23 food-waste-management-system (specific commits). The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system, so version information is not disclosed; the project was informed but has not responded yet.

A vulnerability was found in kishor-23 food-waste-management-system (specific commits). The affected element is the function insert of the file fooddonateform.php of the component Food Donation Form. Performing a manipulation of the argument image-choice results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy, so version details cannot be specified; the project was informed but has not responded yet.

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens and credentials.

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing existing passwords and MFA.

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.

A SQL injection vulnerability was detected in RainyGao DocSys up to 2.02.85 in the BaseController.createDBForMysql function of BaseController.java (Database Management component). Manipulation of the url argument allows SQL injection. The exploit is publicly available and the attack can be executed remotely.

A security flaw was discovered in mooSocial up to 3.2.4 involving SQL injection via manipulation of the rating argument in /stores/all-products. The attack can be initiated remotely and the exploit has been publicly released. The vendor was contacted but did not respond.

A server-side request forgery (SSRF) vulnerability was identified in SciPhi-AI R2R up to 3.6.6 in py/shared/abstractions/llm.py (Retrieval Completion API Endpoint component). Manipulation of the generation_config.api_base argument leads to SSRF. The exploit is publicly available and the attack can be launched remotely.

A hard-coded credentials vulnerability was determined in SciPhi-AI R2R up to 3.6.6 in the JWT Secret Handler component. Manipulation of DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely and the exploit is publicly disclosed.

The Cost Calculator Builder plugin up to version 4.0.17 contains a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.

The WP Statistics plugin up to version 14.16.14 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Gutenberg Blocks by Kadence Blocks plugin up to version 3.7.11.1 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.