CVE Vulnerability Catalog

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected. This allows unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered.

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk. This allows users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root.

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages. This leads to Reflected Cross-Site Scripting (XSS) which could be used against any visitor, including logged-in administrators.

The OpenStation plugin for WordPress (versions up to and including 1.1.7) is vulnerable to authorization bypass. Due to improper verification of user authorization, an authenticated attacker with custom-level access can read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam comments.

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ property to modify the prototype of an object created during serialization in clonePlainJSObject. The malformed serialized object can then cause the React Native application to crash.

A cross-site scripting (XSS) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The echo function in admin/fun/addLog.php does not neutralize the reason/detail arguments, allowing script injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A stored cross-site scripting (XSS) vulnerability in madpsy ka9q_ubersdr before 0.1.58 in the chat message rendering functionality. User-controlled URLs were insufficiently neutralized before being converted into HTML links, and quotation characters could break out of the href attribute and inject arbitrary HTML attributes. This allows arbitrary JavaScript execution in another user's browser without requiring a click.

A vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown functionality of the file example_lite.sql. Manipulation can lead to the use of default credentials. The attack can be launched remotely and the exploit has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf affects an unknown function. The attack can be initiated remotely and the exploit is now public.

An authorization bypass vulnerability in ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Manipulation of the sid/addtime/type/reason/detail/logdate arguments in user/editLog.php leads to authorization bypass. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability in Lemonldap::NG::Handler (Perl) allows bypassing locationRules by using an equivalent spelling of a path. The handler matches regular expressions against the raw REQUEST_URI, while the web server routes on the percent-decoded and normalized path, allowing bypass of deny rules, identity and group conditions, and unprotect and skip rules. Only vhosts whose default rule is more permissive than other rules are affected.

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials.

A vulnerability in containerd (open-source container runtime) prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1. A crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability.

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager with access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.

Apache Airflow HashiCorp provider contains a bypass of the team-scope guard in the HashiCorp Vault secrets backend. A Dag author scoped to one team can supply a Variable key containing a path separator, causing the backend to resolve a secret belonging to a different team. The vulnerability affects multi-team deployments and is reachable from ordinary Dag code.

A vulnerability in chillzhuang SpringBlade up to 5.0.2 affects the UserServiceImpl.userInfo function in the user-auth-info Endpoint component. Manipulation of the userId argument causes authorization bypass, allowing remote attack.

A vulnerability in jhen0409 react-native-debugger up to 0.14.0 affects the openDevTools function in electron/window.js. Manipulation of the host argument results in OS command injection, allowing remote attack.