CVE Vulnerability Catalog

SureCart plugin prior to version 4.2.1 is vulnerable to authenticated SQL injection. The vulnerability exists in the REST API endpoint '/surecart/v1/integrations/{id}' via parameters 'model_name', 'model_id', 'integration_id', 'provider'. The root cause is a bypass of the escaping mechanism in the 'wp-query-builder' - values containing a dot ('.') or WordPress table prefix ('wp_') are not properly sanitized.

SQL Injection vulnerability in NextGEN Gallery prior to version 4.2.1. An authenticated attacker with 'NextGEN Gallery overview' capability can inject arbitrary SQL into the ORDER BY clause via the 'orderby' parameter in REST API endpoints. Root cause is insufficient sanitization in '_clean_column()' using a blacklist approach.

The Boost plugin for WordPress up to version 2.0.3 is vulnerable to PHP Object Injection via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.

The Easy Elements for Elementor plugin for WordPress up to version 1.4.4 allows unauthenticated attackers to register with the administrator role. The 'easyel_handle_register' function does not restrict user roles during registration.

The ProSolution WP Client plugin for WordPress up to version 2.0.0 has an arbitrary file upload vulnerability due to array validation mismatch – only the first file is validated, but all are uploaded.

Missing authorization in the Date iCal module for Drupal allows forceful browsing, enabling unauthorized access to resources. Affects versions before 4.0.15.

CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the web-based installer (public/installer/index.php) is vulnerable to unauthenticated Remote Code Execution (RCE) because it performs the install.lock check only after including and executing form handler files, leaving installer endpoints reachable on already-installed instances. The handlers also pass unsanitized user input directly into shell commands, allowing an attacker to submit crafted requests that execute arbitrary commands on the server. The vulnerability stems from two combined weaknesses: (1) premature form handler execution before the lock file gate, and (2) unsafe use of user input in shell command construction. This issue is reported to be actively exploited in the wild. The issue has been fixed in version 1.2.0.

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

In ScadaBR version 1.2.0, use of hard-coded credentials allows an attacker to access the SCADA system as admin.

ScadaBR version 1.2.0 contains an OS command injection vulnerability. An attacker can execute arbitrary commands as root on the SCADA system.

ScadaBR version 1.2.0 has a missing authentication for critical function vulnerability, allowing an unauthenticated attacker to send HTTP GET requests to the SCADA system and inject arbitrary sensor readings.

The embedded HTTP server in Panabit PAP-XM320 up to version 7.7 fails to validate session cookie values, allowing authentication bypass via directory traversal.

An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via the url parameter.

APScheduler in all versions (including 3.10.x and 4.0.0a5) is vulnerable to Remote Code Execution (RCE) via insecure deserialization in JSONSerializer and CBORSerializer. The unmarshal_object function allows arbitrary class instantiation and state injection by dynamically importing modules and calling __setstate__ on any available Python class.

API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. Unauthenticated remote attackers can exploit this to dump all user records (including bcrypt password hashes) via /api/user/getUserData, modify drug inventory, and access private medical prescription data via /api/doctorOder.

LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint does not validate the role parameter.

scalar/astro v0.1.13 contains an SSRF vulnerability in the scalar_url parameter of the Scalar Proxy endpoint. Unauthenticated attackers can force the backend server to send HTTP requests to attacker-controlled URLs.

In scalar/astro v0.1.13, an arbitrary file upload vulnerability exists via the scalar_url parameter of the Scalar Proxy endpoint. An attacker can upload a crafted SVG file, leading to arbitrary code execution.

Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change credentials before deployment. The product has not been distributed since December 2020 and is unsupported since 2021.