CVE Vulnerability Catalog

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress in all versions up to and including 32.0.1 is vulnerable to Unauthenticated Arbitrary File Overwrite due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This allows authenticated attackers with subscriber-level access and above to overwrite known files, which may lead to remote code execution when certain preconditions are met.

The WP-Lister Lite for eBay plugin for WordPress in all versions up to and including 3.8.9 is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

A vulnerability has been found in the a2ui project (up to version 0.10.7) in the httpx.get function of file_resolver.py within the FileResolver component. Input manipulation leads to Server-Side Request Forgery (SSRF). The attack can be launched remotely, and the patch is identified by 2bb8423060308bbdea8ba468dabed4fc256d18ea.

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker can inject a specially crafted IS-IS LSP PDU, causing the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello PDU that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. The vulnerability is remotely exploitable.

A heap-based buffer overflow vulnerability exists in Microsoft Edge (Chromium-based). An unauthorized attacker can exploit this to execute code over a network.

A heap-based buffer overflow vulnerability exists in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD file, an integer overflow occurs during multiplication of values from an embedded JPEG header, leading to an undersized heap allocation and a heap-based buffer overflow during image decoding.

A difficult-to-exploit vulnerability exists in Oracle GraalVM for JDK and Oracle GraalVM (Compiler component). An unauthenticated attacker with network access via HTTP can exploit this to compromise Oracle GraalVM for JDK and Oracle GraalVM.

Vulnerability in Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and Oracle GraalVM (component: Compiler). Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all data, as well as unauthorized update, insert, or delete access to some data and partial denial of service.

Vulnerability in Oracle GraalVM for JDK and Oracle GraalVM (component: Compiler). Difficult to exploit, allows an unauthenticated attacker with network access via HTTP to take over the Oracle GraalVM system.

Vulnerability in Netcore NR255-V version 1.5.130703 involves an out-of-bounds read in the mtd_write pre-flash validation routine triggered by short firmware uploads. Attackers can upload a truncated firmware image via put_file_cgi.c to trigger out-of-bounds reads across main.c, check_image_uuid.c, and oemMD5Update.c.

Vulnerability in Netcore NR255-V version 1.5.130703 is a stack-based buffer overflow in reboot_timer_set.cgi caused by improper sscanf token parsing. Attackers can exploit this flaw by submitting crafted input to the affected endpoint to corrupt stack memory.