CVE Vulnerability Catalog

The Ad Inserter plugin for WordPress (versions up to and including 2.8.19) is vulnerable to arbitrary shortcode execution because it allows users to execute an action without properly validating a value before running do_shortcode. An unauthenticated attacker can execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.

In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.

In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.

In DBHub prior to version 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. A double dash followed by a non-whitespace character can hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection, can bypass read-only mode to modify or drop database data.

In ZAC prior to version 5.2.0, by-id read endpoints in ZaakRestService.kt omit assertPolicy authorization. An authenticated low-privileged municipal user who knows a case or decision UUID can read decisions, audit history, and BPMN workflow state across unauthorized case types. The advisory also identifies the afzender endpoint as exposing mailbox configuration without a policy check.

In SecureDrop from version 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request. An attacker who already has access to the Journalist Interface onion address, the required authentication, and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry (at most eight hours).

In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.

A Cross Site Scripting (XSS) vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality and chat messaging component. The provided description lacks details on the attack vector.

The APIExperts Square for WooCommerce (woosquare) plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. The issue affects versions from n/a through 4.7.5. This may allow an attacker to force an authenticated user to perform unwanted actions.

The Events Calendar (the-events-calendar) plugin contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 6.18.2. This may enable unauthorized access to features or data.

The Media Player Addons for Elementor (media-player-addons-for-elementor) plugin contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 1.1.10. This may allow stored XSS.

Wekan, an open source kanban built with Meteor, prior to 11.11 passes authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. In MongoDB-backed deployments the resulting patterns are evaluated with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users. The searchUsers method additionally requires board membership or site-admin status.

gopacket, a Go packet processing library, prior to 1.7.2 passes attacker-controlled declared lengths and counts in layers/sctp.go to the SCTP sub-decoders (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, decodeSCTPParameter) without checking that each chunk contains the required fields. A crafted SCTP segment can cause out-of-bounds or inverted slice panics. The panic can terminate applications using SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic; default recovery-enabled APIs convert it to a per-packet decode error.

croc, a tool for securely transferring files and folders between computers, prior to 11.5.2 treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact in the receive-side file-readiness loop (src/croc/croc.go), even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite, truncate, or replace a matching file without confirmation.

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possibly older versions. The authorization check introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated user to run a pod on the management cluster.

The Fluent CRM WordPress plugin through version 3.2.6 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured access controls.

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks, causing heap over-reads that lead to crashes or heap memory disclosure.