CVE Vulnerability Catalog

The WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) is vulnerable to blind SQL Injection via the 'order_by' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with custom-level access or higher can append additional SQL queries to existing queries, allowing extraction of sensitive information from the database.

The Advanced Popups plugin for WordPress (all versions up to and including 1.2.3) is vulnerable to Stored Cross-Site Scripting via the 'Notification Button Link' field due to insufficient input sanitization and output escaping. An authenticated attacker with author-level access or higher can inject arbitrary web scripts into pages that execute when users visit them.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (all versions up to and including 2.8.16) is vulnerable to authorization bypass due to a missing capability check on the 'ai-debug-code' URL parameter. An unauthenticated attacker can view administrator-configured header and footer code blocks that have been disabled from public display.

A security vulnerability has been detected in synaptik-cms (up to version 1.3.4.4) in the rename function of admin/file-manager.php within the Admin File Manager component. Manipulation leads to unrestricted file upload. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used. Upgrading to version 1.3.5 mitigates this issue.

A vulnerability was determined in gedelumbung HospitalManagement (up to c2d45543789a3887067d3915f69d44cfc2cf76a8) in the generate_index_pasien function of application/models/app_global_admin_model.php. Manipulation of the 'cari' argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized. The project has not responded to the issue report.

A vulnerability was found in vLLM versions 0.26.0 and 0.27.0 within the MoRIIO Acknowledgement Handler component. Manipulation of the request_id/kv_transfer_params arguments in MoRIIOConnectorScheduler.request_finished, MoRIIOConnectorWorker.get_finished, and MoRIIOWrapper._handle_release_message leads to resource consumption. The attack can be initiated remotely, and the project has not yet reacted to the report.

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because it does not restrict the digest algorithm used for artifact verification. An attacker with sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible to be carried out remotely. The patch is named fb8e85aec78d04e81feb9992a57638ca1ec4dc1b. It is suggested to install a patch to address this issue.

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forgery. The attack can be executed remotely. The patch is identified as bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189. It is advisable to implement a patch to correct this issue.

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

Netcore NR255-V version 1.5.130703 exposes sensitive information through l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json read handlers. An attacker can query l2tpd_config_show.cgi to retrieve stored IPsec PSK and RSA key material.

Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a string handling API. An attacker can trigger an unterminated buffer over-read, potentially exposing adjacent memory contents.

A vulnerability was identified in a2ui-project a2ui up to 0.10.6, affecting an unknown function in renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts within the Basic Catalog component. The manipulation leads to inefficient regular expression complexity and can be triggered remotely.