CVE Vulnerability Catalog

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page. Unauthenticated attackers can execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block mode are affected.

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential. This allows the holder of a read-only key to act as the administrator account that issued it.

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalize a donor's e-mail address between the value it stores and the value it later uses to look that donor up. This allows unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute. This allows unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.

The Ni WooCommerce Sales Report plugin before 4.2.0 does not sanitise and escape a parameter before using it in SQL statement, allowing unauthenticated users to perform SQL injection attacks.

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress in all versions up to and including 32.0.1 is vulnerable to Unauthenticated Arbitrary File Overwrite due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This allows authenticated attackers with subscriber-level access and above to overwrite known files, which may lead to remote code execution when certain preconditions are met.

The WP-Lister Lite for eBay plugin for WordPress in all versions up to and including 3.8.9 is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

A vulnerability has been found in the a2ui project (up to version 0.10.7) in the httpx.get function of file_resolver.py within the FileResolver component. Input manipulation leads to Server-Side Request Forgery (SSRF). The attack can be launched remotely, and the patch is identified by 2bb8423060308bbdea8ba468dabed4fc256d18ea.

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker can inject a specially crafted IS-IS LSP PDU, causing the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello PDU that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.