CVE Vulnerability Catalog

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts plugin for WordPress before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request. This allows unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.4) is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) field submission due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.

The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316) is vulnerable to Privilege Escalation. The Register & Login add-on's before_email_success_msg() function in the register_login_action='update' flow trusts an attacker-supplied user_id value and passes it to wp_update_user() without any ownership or capability check. An authenticated attacker with Subscriber-level access can create a malicious form and submit it with an administrator's user_id and a new password/email, resulting in account takeover.

The CTX Feed Pro plugin for WordPress up to version 7.6.12 is vulnerable to code injection due to insufficient input validation on the 'Feed Config' field, which is passed directly to the eval() function. This allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server.

The Visitors Traffic Real Time Statistics Pro plugin for WordPress up to version 11.22 is vulnerable to unauthenticated stored Cross-Site Scripting via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is accessible to logged-out users and stores the value without sanitization, which is later rendered in the admin dashboard without escaping, allowing arbitrary JavaScript execution.

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The manipulation of the Title argument in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity results in SQL injection. The attack can be launched remotely, and the exploit is now public.

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. The function fetch_url in mcp_server_fetch/server.py is affected by manipulation of the url/path argument, leading to server-side request forgery. The attack can be initiated remotely, and the exploit has been publicly disclosed. A fix is awaiting acceptance.

The vulnerability involves transmitting a sensitive key in the URL over an unencrypted HTTP connection. The key is sent in plaintext, allowing an attacker monitoring network traffic to intercept it.

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

ClipBucket v5 through 5.5.3-#197 contains an SQL injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can use time-based blind payloads to extract user credentials and emails or modify and delete arbitrary records.

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.

A flaw was found in 389-ds-base where an unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

An OS Command Injection vulnerability exists in Johnson Controls EasyIO FS32. This issue affects EasyIO FS32 versions before 3.0b63.

A Cleartext Transmission of Sensitive Information vulnerability exists in Johnson Controls EasyIO NEO. This issue affects EasyIO NEO versions before 3.3b25 and enables Man-In-The-Middle attacks.

Directory Traversal vulnerability in langflow up to 1.8.4. Through the knowledge base creation endpoint, an attacker can write or overwrite files outside the intended working directory using absolute paths.

In Devika v1.0, the Patcher Agent's save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.

An On-Chip Debug Interface vulnerability exists in Johnson Controls Neo Series MVP2 that allows collecting data from common resource locations. This issue affects Neo Series MVP2 versions before 3.3b63.

An On-Chip Debug Interface vulnerability exists in Johnson Controls EasyIO FS32 that allows collecting data from common resource locations. This issue affects EasyIO FS32 versions before 3.3b63.