CVE Vulnerability Catalog

Insufficiently Protected Credentials in the tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access access keys, secret keys, and deployment secrets.

The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object, and the presence of a POP chain allows remote code execution by writing a webshell to the uploads directory.

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'animated-text' shortcode. The atb_shortcode_handler() function fetches an arbitrary post by attacker-supplied ID and, without capability checks or post_type validation, displays its content, allowing authenticated attackers with Contributor-level access or higher to read rendered content of any published post, including non-public custom post types.

The affiliate-toolkit plugin for WordPress is vulnerable to Arbitrary File Upload via the upload_image function. Due to insufficient file type validation (weak Content-Type prefix check and extension derivation from attacker-controlled URL path), an authenticated attacker with Contributor-level access or higher can upload executable files, enabling remote code execution. Exploitation requires the 'import product image' option to be enabled.

The AMP for WP – Accelerated Mobile Pages plugin for WordPress up to and including 1.1.17 is vulnerable to stored cross-site scripting via the 'headline-*' shortcode attribute due to insufficient input sanitization and output escaping. A Subscriber-level user can store a malicious shortcode in their biographical info field that executes when a user accesses the page.

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code.

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it through the language parameter to execute code on the server.

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress up to and including 3.9.2 is vulnerable to stored cross-site scripting via the 'atkp_product_producturl' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user accesses the page if AJAX loading is enabled and a product ID is known; on a default installation, contributor-level access is required.

The AI Marketing Expert plugin for WordPress up to and including 1.2.8 is vulnerable to stored DOM-based cross-site scripting via the 'name' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator opens wp-admin/index.php, provided the chatbot module is active with at least one configured bot.

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like setUserItem, creating root-access users or changing server configuration.

qEngine CMS, Kemana Directory, and Cart Engine contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.

Linksys WAG200G contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.

Integer overflow vulnerability in ProtobufParser._readStringKey() in the Jackson protobuf parser. A malformed protobuf message with a map key length of 0x7FFFFFFF causes signed arithmetic overflow in the bounds check, leading to an attempt to allocate a huge buffer and an OutOfMemoryError. StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not prevent the failure.

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes the value without the overflow guard present in the blocking parser, and _startRawBinary immediately allocates the declared length. A roughly ten-byte input can force an allocation of about 2 GB, causing OutOfMemoryError or NegativeArraySizeException.

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then calling _finishShortText(len), both using 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and TextBuffer.expandCurrentSegment(len) performs Arrays.copyOf with no cap and throws OutOfMemoryError. maxStringLength and maxDocumentLength do not gate this path.

In Nuxt Ollama prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests.

In GRR prior to version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges.