CVE Vulnerability Catalog

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

The YS LeadGen plugin for WordPress in all versions up to and including 2.1.4 is vulnerable to Sensitive Information Exposure. The 'ysleadgen_get_captured_data' AJAX action is accessible to unauthenticated users, allowing retrieval of all captured form submission data, including personally identifiable information (names, email addresses, message content).

The ProfilePress plugin for WordPress in all versions up to and including 4.17.2 is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, allowing authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes.

The Welcomizer plugin for WordPress in all versions up to and including 2.8.1 is vulnerable to Remote Code Execution (RCE). Missing authorization checks on the 'twiz_ajax_callback' AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied code allows authenticated attackers with Subscriber-level access and above to inject arbitrary PHP code.

The Quill Forms plugin for WordPress in all versions up to and including 5.7.1 is vulnerable to Stored Cross-Site Scripting via the Multiple Choice 'Other' value. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary web scripts that execute in the WordPress admin results view.

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints. This allows unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

The Save as PDF Plugin by PDFCrowd for WordPress (versions up to and including 4.6.1) is vulnerable to arbitrary function invocation via the pdf_created_callback shortcode attribute. The eval_shortcode() function copies attributes without sanitization, which are then encrypted and passed to an unauthenticated endpoint where they are decrypted and invoked without an is_callable() check. An authenticated attacker with Contributor-level access can invoke arbitrary PHP functions.

The WP Photo Album Plus plugin for WordPress (all versions) is vulnerable to remote code execution via the wppa_image_magick function. Insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command executed via exec(), with only escapeshellcmd() applied to the whole command. An authenticated attacker with subscriber-level access can execute code on the server.