CVE Vulnerability Catalog

Broken Access Control vulnerability in Aruba Migration Tool up to version 1.0.4 allows a subscriber to gain unauthorized access to administrative functions.

Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation up to version 5.9.3 allows an attacker to access resources without authorization.

Vulnerability in boks_ksllogsd allows an authenticated KSL client to supply an oversized digest name, leading to a heap buffer overflow.

HCL BigFix Service Management has an information disclosure vulnerability because two exposed API endpoints return sensitive data, potentially enabling further serious attacks.

HCL BigFix Service Management has an information disclosure vulnerability that allows an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling discovery of hidden administrative API endpoints.

Unauthenticated bypass vulnerability in hCaptcha for WP up to version 5.3.0 allows an attacker to bypass security mechanisms.

Vulnerability in Next.js versions 16.3.0 to 16.3.7 causes incorrect cache keying for 'use cache' handlers, potentially leaking return values across different root params.

iControl is affected by an insecure CORS policy, allowing a malicious website to execute cross-origin requests with credentials. An attacker could access and exfiltrate sensitive data within the victim's active session.

Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every requested channel of each pixel into it. Requesting more than one channel writes past its end. An attacker-supplied image controls the overflowing bytes through its palette.

WpTravelly plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.3.1.

ProfileGrid plugin has an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 6.0.0.2.

CF7 Apps plugin has a sensitive information insertion vulnerability, allowing retrieval of embedded sensitive data. Affects versions up to 3.7.2.

Pie Register plugin has a sensitive information insertion vulnerability, allowing retrieval of embedded sensitive data. Affects versions up to 3.8.4.13.

FluentForm plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 6.2.14.

Unlimited Elements For Elementor plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.0.20.

Site Reviews plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 8.3.2.

Metform plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 4.3.0.

ElementsKit Elementor addons Lite plugin has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions up to 4.0.6.

The ElementsKit Elementor addons Lite plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 4.0.6. An attacker can inject malicious script that will execute in the browser of an administrator or other user.

The Essential Addons for Elementor plugin for WordPress contains a Stored XSS vulnerability in versions up to and including 6.8.4. An attacker can inject malicious script that will execute in the browser of an administrator or other user.