CVE Vulnerability Catalog

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the Local HTTP Service component. The manipulation results in missing authentication, and the attack is only possible with local access. The exploit has been made public and could be used.

A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the Virtual Server Page component. The manipulation leads to cross site scripting, and remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

benotes up to version 2.8.1 contains a Server-Side Request Forgery vulnerability in the getUrlInfo function of app/Http/Controllers/PostController.php, within the Bookmark Metadata Endpoint component. Manipulation of the url argument leads to server-side request forgery.

EasyImage up to version 2.8.7 contains a vulnerability in an unknown function of app/del.php involving improper privilege management. Manipulation of the hash argument can lead to privilege escalation.

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the OLE2 Parser component. The manipulation leads to heap-based buffer overflow, and the attack can be initiated remotely.

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers. This allows unauthenticated users to make donations below a form's configured minimum or fixed amount.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6ComFile!CCheck::ItemCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::CheckSymbolMacroParam. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

FUJI ELECTRIC's V-SFT contains a stack-based buffer overflow vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product.

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes. This allows unauthenticated attackers to mark arbitrary orders as paid, cancel arbitrary orders, and disclose order details including customer contact information.

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default. This allows unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation. This allows unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default. This allows unauthenticated attackers to mark any pending order as paid and to force any order into a failed status without any secret at all.

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback. This allows unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install. This allows unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.

In NocoDB up to 2026.07.0, the validatePassword function in /auth/user/signup does not adequately restrict excessive authentication attempts. The flaw enables a remote attack of high complexity, and the vendor describes this behavior as intentional. The GitHub issue was deleted without explanation and email contact went unanswered.