CVE Vulnerability Catalog

The Tabs Responsive WordPress plugin through version 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Manipulation of the argument filter leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used.

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

The Mooncake transfer engine through version 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to block the handshake daemon by never reading replies. Attackers can send a Metadata request to the handshake RPC port and stall SocketHandShakePlugin's single listener thread in writeFully(), breaking all subsequent handshakes, metadata fetches, notify and probe requests.

Office-PowerPoint-MCP-Server through version 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files.

A Cross-Site Scripting (XSS) vulnerability in CAPEC-63 before version 3.0b63 is due to improper neutralization of input during web page generation (CWE-79). This allows an attacker to inject malicious scripts into pages that execute in the victim's browser.

An External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows path traversal attacks. This allows an attacker to manipulate file paths to access files outside the intended directory.

An Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 before version 3.0b63 allows authentication abuse. This may allow an attacker to exploit default settings for unauthorized access.

An Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo before version 3.3b63 allows collecting data from common resource locations. An attacker can exploit this to access confidential data stored in the system.

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.

Authorization bypass vulnerability in deeptutor 1.4.0 in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.

A Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG before version 2.0b52 allows password spraying attacks. An attacker can exploit known default credentials to gain unauthorized access.

PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand() PRNG to generate the delete_code authorization token in src/inc/core.php. Attackers can predict or infer the PRNG state to guess valid delete_code values and perform unauthorized deletion of hosted files without needing to read the code from the info endpoint.

A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. The issue is fixed in version 3.35.0.

Johnson Controls EasyIO FS32 before version 3.0b63 contains an OS Command Injection vulnerability that allows command injection. An attacker can execute arbitrary commands on the system.