CVE Vulnerability Catalog

In the esaml library (dropbox), esaml_binding:decode_response/2 parses the decoded SAMLResponse with xmerl_scan:string/2, which interns every element name, attribute name, and namespace prefix as a permanent atom. The ACS and single-logout endpoints call it on unauthenticated requests before any signature check, so one document with thousands of distinct names mints thousands of atoms within the 128 KB body limit. Atoms are never reclaimed and the VM caps the atom table at about one million entries, so a few dozen requests can abort the node.

An out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (versions 4.1.0 to 5.3.0) occurs because the input size check did not include the preamble, allowing a truncated sketch to cause a read past the end. Additionally, the table size is computed in 32-bit arithmetic, which can wrap to zero, leading to an empty table and subsequent out-of-bounds reads and writes, corrupting heap memory.

The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

The MasterStudy LMS WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor. This allows users with the Instructor role to overwrite the first name, last name, and public display name of any registered user, including administrators, enabling impersonation and phishing.

The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.

WordPress Core (all versions up to and including 7.0.2) is vulnerable to stored Cross-Site Scripting via Quick Edit due to insufficient escaping of user display names. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a higher-privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

The WordPress plugin Photo Engine (Media Organizer & Lightroom) before version 6.5.8 does not verify that a user is authorized to act on the targeted media attachment. Authenticated users with the author role and above can delete arbitrary attachments, including those uploaded by other users and administrators.

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for. Any party with a valid token is authenticated as the token's owning user (an administrator by default) across the entire REST API without a nonce, leading to full site takeover.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature. This allows users with a role as low as Contributor to read the configuration of admin-only custom post types and taxonomies, as well as the titles, dates, statuses and some stored content of other users' non-public posts and pages.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state.

The PixelYourSite WordPress plugin before 11.4.3 and PixelYourSite Pro before 12.6.8 do not sanitise and escape a cookie value before printing it into the page output. On a site running a full-page cache, this allows unauthenticated attackers to store a Cross-Site Scripting payload in the cached page that is then served to other visitors.

The Infility Global WordPress plugin before version 2.16.25 does not perform any authorization or nonce check on an AJAX action available to unauthenticated users. This allows any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before version 2.16.25.

The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who already holds that role to grant it administrator-level capabilities and escalate their privileges.

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all review fields submitted through its public review form, which is available to unauthenticated visitors. This allows execution of arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.

The FluentCart WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

NT OneAPP developed by NewType Infortech has an exposure of sensitive information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.

NT OneAPP by NewType Infortech contains an authentication bypass vulnerability. An unauthenticated local attacker can bypass the App PIN lock mechanism via a Deep Link and access protected resources of a logged-in user.

NT OneAPP by NewType Infortech has a credential disclosure vulnerability. Under specific conditions, an unauthenticated remote attacker can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView, obtaining the NUP Portal passcode of a logged-in user.

NT OneAPP by NewType Infortech has an improper certificate validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack because the application fails to validate the server certificate and hostname, intercepting or modifying communications between the application and the server.