CVE Vulnerability Catalog

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to privilege escalation via contact identity rebinding. The create_contact function in the v3 REST endpoint is gated only by the add_contacts capability and forwards the full payload, including user_id, to the upsert path, bypassing ownership guards. This allows attackers with Sales Representative-level access and above to rebind a contact to an Administrator's user ID and then use the v4 email-test endpoint to gain an admin session.

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via comments in versions up to and including 5.3.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when a user accesses the page. Exploitation requires comment moderation.

The ProfilePress plugin for WordPress is vulnerable to sensitive information exposure in versions up to and including 4.17.4 via the get_user_profile_structure function. Authenticated attackers with subscriber-level access and above can extract other users' email addresses, login names, and registration dates. When the users_can_register option is enabled, unauthenticated attackers can also exploit this via registration.

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in versions up to and including 2.13.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator opens the user record in the wp-admin modal.

The Ultimate Member plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.13.1. Unauthenticated attackers can view privacy-restricted member profile field values, including owner-only, members-only, or role-restricted fields, by querying the public wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint is available to all visitors.

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, and can then decrypt the stored credentials of any specific installation to which the attacker separately obtains the encrypted configuration file.

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenSearch cluster, or the cloud instance-metadata service, exposing sensitive internal data rendered into the returned PDF.

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder(). An authenticated attacker can inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query. The GET /api/utm-asset-groups/searchGroupsByFilter endpoint can be exploited to execute arbitrary SQL with DBA privileges.

The Wallstreet plugin for WordPress (Webriti Wallstreet) through version 2.8.6 contains a Cross-Site Request Forgery (CSRF) vulnerability. This allows an attacker to force an authenticated user to perform unintended actions in their context.

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post). Authenticated API key holders can bypass the security.restrict_access confidentiality control because the allowAccess() routine is never invoked. Attackers can read restricted issue contents and comments, including owner and author email addresses, and post unauthorized comments.

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, causing downstream authorization checks to treat the request as agent-privileged. An authenticated EST user can obtain CA-signed certificates with arbitrary subject names.

LangGraph Python SDK (langgraph-sdk) from 0.1.45 to 0.4.4 contains a vulnerability in the resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons. These decorators ignore the actions argument and register the selected handler for every action on the resource. Because the wildcard handler is selected before broader fallback handlers, an authenticated user may bypass ownership and permission checks and read, update, or delete another user's resource. Only Python deployments using actions on the affected decorators are vulnerable. Fixed in version 0.4.4.