CVE Vulnerability Catalog

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret. This allows unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without completing payment.

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads. Unauthenticated users can bypass the payment requirement and retrieve any product's paid downloadable file.

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers. Users with subscriber-level access and above can overwrite the plugin's stored settings, including stored API credentials and feature and template configuration.

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory. Unauthenticated attackers can read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify the RMC filesystem.

The report was rejected by Red Hat Product Security, which determined it is not a vulnerability in bootc or containers-common. The default /etc/containers/policy.json allows insecureAcceptAnything for registries without an explicit signature requirement, while registry.redhat.io and registry.access.redhat.com require signatures. Updating a mutable tag requires the ability to publish to the reference an administrator has configured, and signature enforcement can be enabled via policy or bootc enforce-container-sigpolicy (off by default).

A vulnerability in ESPnet up to 202610.post2 affects the build_model function in espnet3/publication/inference_model.py of the Inference Model Handler component. Manipulation of the _target_ argument results in deserialization, and the attack can be launched remotely. The exploit has been made public, and the patch is identified as f217b24f06de55e332cab10231469d5890dbbe00.

A security flaw in sgl-project SGLang up to 0.5.19 affects the WeightExporter.send_weights_to_remote_instance function in python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the Weight Exporter component. Manipulation of the group_name argument results in denial of service, and the attack can be initiated remotely. The exploit has been released to the public, and the pull request to fix this issue awaits acceptance.

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A vulnerability was found in HanLP up to 2.1.0-beta.64 in the hanlp.load function of reflection.py, related to model config loading. Manipulating the classpath argument causes deserialization, enabling remote attacks. The exploit has been publicly disclosed and the project has not yet responded.

A vulnerability in the domain creation functionality of SME Server 11.0rc1-215 allows an attacker with high privileges to inject reserved Apache configuration directives. This corrupts httpd.conf and prevents Apache from starting after a reboot, causing a denial-of-service (DoS) condition affecting the web server and hosted virtual hosts.

A path traversal vulnerability exists in the View Logs functionality of koozali's SME Server version 11.0rc1-215. An unauthenticated attacker can access files outside the intended directory, leading to exfiltration of potentially sensitive system and application files.

The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and unconditionally registers the SVG MIME type in the WordPress media library. This allows authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons. This allows unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler. This allows unauthenticated attackers to mark orders as paid without actually paying.

A vulnerability was found in LlamaChinese Llama-Chinese in the get_class_from_dynamic_module function of examples/chat_gradio_no_merge.py. Manipulating the base_model_name_or_path argument results in code injection, and the attack can be performed remotely. The exploit has been made public and could be used.

A vulnerability has been found in hankcs HanLP in the load_word2vec_as_vocab_tensor function of hanlp/utils/torch_util.py. Manipulating the vectors.vocab argument leads to deserialization, and the attack is possible remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI in the change_info_ function of webui.py. Manipulating the ckpt_path argument can lead to code injection, and the attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in radareorg radare2 in the r_core_cmd_str_pipe function of libr/core/rtr_http.inc.c, related to the HTTP sandbox policy handler. Manipulation results in a protection mechanism failure, and remote exploitation is possible though highly complex. The issue is fixed in version 6.2.4 (commit 18fd12efa98a7d1977de7bdd379d8a848777b90f).