CVE Vulnerability Catalog

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomRuta' at endpoint '/es/routes/update/693'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomTransportista' at endpoint '/es/carriers/update'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomZonaGeo' at endpoint '/es/geozones/update/149979'.

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows exploiting incorrectly configured access control security levels. This issue affects LearnPress from n/a through 4.4.9.

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could trick a user into opening content that embeds or references a specially crafted CID-keyed font, causing repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

cjbassi/gotop is vulnerable to local argument injection via its process termination functionality. The process name is passed directly to pkill without sanitization, so a local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. The product is no longer actively supported and the vulnerability has not been fixed; it was confirmed at version 3.0.0.

Server-Side Request Forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects versions before 2.1. Note: The vendor was contacted and it was learned that the product is not supported.

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects versions before 2.1. Note: The vendor was contacted and it was learned that the product is not supported.

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The endpoint "/es/datatables/getemployeetypesdatatable" is affected.

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "nomListaValidacion" parameter is affected – endpoint "/es/validationslists/assignList/Employee/45659".

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "name" parameter is affected – endpoint "/es/attachmenttypes/update/203336".

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lsd[remark]' parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (versions up to and including 5.7.1) is vulnerable to Insecure Direct Object Reference. A public, unauthenticated AJAX endpoint loads an invoice by a sequential invoice_id without ownership or access-key verification, allowing attackers to enumerate invoices and create or overwrite transaction intents.

The Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 13.2.0) is vulnerable to Reflected Cross-Site Scripting via the '{{GET:}}' Dynamic Placeholder. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts that execute when a user is tricked into clicking a crafted link.

In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted input being processed, without bounding them, so a small input could dictate an arbitrary amount of work before any password or integrity check could reject it. The affected paths are the RFC 9579 PBMAC1 MAC calculator builders, the scrypt parallelization parameter p in the PKCS#8 and PKCS#12 cost guards, the raw JCA PBKDF2 provider, and the bcrypt round count read from an encrypted OpenSSH v1 private key's own kdfoptions. Each now bounds the parameter before deriving, in line with the caps already applied elsewhere in the tree, with the OpenSSH round count configurable through the new org.bouncycastle.openssh.max_rounds property. This completes the bounding begun in 1.85 for the PKCS#8 / PBES2 decryptors (CVE-2026-15055). This issue also affects Bouncy Castle for Java LTS before 2.73.13, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).

The Dc Woocommerce Multi Vendor plugin for WordPress (versions up to and including 5.0.18) is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. The value is concatenated directly into an ORDER BY clause and esc_sql() provides no protection, allowing authenticated attackers with vendor-level access (edit_stores capability) to append additional SQL queries.

Improper certificate validation in PkixNameConstraintValidator in Bouncy Castle for .NET (bc-csharp) before 2.7.0 allows an attacker who controls or can obtain certificates from a name-constrained intermediate CA to have certificates accepted for email addresses, DNS names, or URI hosts within excluded subtrees, via names ending with a dot (e.g., rfc822Name, dNSName, uniformResourceIdentifier), because comparison does not remove the trailing root-label dot per RFC 1034.

The MStore API WordPress plugin before 4.22.1 does not restrict which order fields a customer may update. Any authenticated user with a self-registerable account can change the status of their own unpaid order to a paid or fulfilled state and receive goods without paying.