CVE Vulnerability Catalog

The zportals WordPress plugin before version 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals plugin's stored integration settings.

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request. This allows attackers to read any subscriber's personal data and overwrite any subscriber's record, including their email address.

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor. This allows users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.

XSS vulnerability in Auktion NG Auktionssoftware up to 20260722. Attack via manipulation of email argument in /forgotpasswd.html in Public Password Reset Endpoint. Remote exploitation possible, exploit public.

XSS vulnerability in Smart Attendance System with QR Code Scanner 1.0. Attack via manipulation of full_name argument in prepend function of student_signup.php in Self-Registration component. Remote attack, exploit public.

SSRF vulnerability in iFlytek astron-agent up to 1.0.6. Affects UrlCheckTool.checkUrl in debugToolV2 API endpoint. Manipulation of endPoint argument allows remote SSRF. Patch available in version reward-1575.

SQL Injection vulnerability in iFlytek astron-agent up to 1.0.7. Affects function in ChatBotMarketMapper.xml in getBotList API endpoint. Manipulation of sortDirection argument allows remote SQL injection. Patch in version reward-1575.

Deserialization vulnerability in recommenders-team recommenders up to 1.2.1. Affects pickle.load in mind_iterator.py in Dict Loading component. Remote attack, exploit public.

Vulnerability in Ghidra before 12.1.4. Failure to validate TYPE_COL byte in OptionsDB.createUnregisteredOption() causes ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Malicious database file can cause application stall and prevent resource cleanup.

Deserialization vulnerability in Dask up to 2026.8.0. Affects from_npy_stack in dask/array/core.py in Loader component. Remote attack, exploit public.

SQL Injection vulnerability in Restaurant-Management-System up to specific commit. Affects mysqli_query in admin/display_menu.php in Search Form component. Manipulation of s1 argument allows remote SQL injection. Exploit public.

SQL Injection vulnerability in Leave Management System 1.0. Affects unknown function in /module/leavetype/index.php. Manipulation of ID argument allows remote SQL injection. Exploit public.

Unrestricted upload vulnerability in Pixtream up to specific commit. Affects unknown processing in /post_upload.php. Manipulation of media argument allows remote attack. Exploit public.

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. It affects the PaginationInnerInterceptor.concatOrderBy function in MybatisPlusConfig.java, where manipulation of the orders[0].column argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design lacking a per-device secret or server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and reset the administrator password. The design has been present since at least firmware 2.2.3.4.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls on non-TLS web interfaces and disclose configuration information. The design has been present since at least firmware 2.2.3.4.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required for administrator takeover. The design has been present since at least firmware 2.2.3.4.

A vulnerability was determined in Mstfakts College-Management-System affecting the session_start function in Front-end/server.php within the Authentication component. Manipulation leads to session fixation. The attack can be launched remotely and the exploit has been publicly disclosed. The product uses rolling releases, so version details are unavailable. The project was informed but has not responded.

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. It affects unknown functionality of /dashboard/userprofile.php?section=admin1. Manipulation of the image argument results in unrestricted upload. The attack can be launched remotely and the exploit has been made public. The product uses rolling releases, so no version details are available. The vendor was contacted but did not respond.

plone.app.dexterity is a content-type system for Plone, and plone.app.contenttypes provides Dexterity-based content types. Versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0 of plone.app.dexterity, and through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 of plone.app.contenttypes are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity 3.2.3, 4.1.3, and 5.0.1, and plone.app.contenttypes 3.0.12, 4.0.10, and 5.0.1.