CVE Vulnerability Catalog

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API parameters (interval, format, emailTo) in all versions up to and including 3.0.3 due to insufficient input sanitization and output escaping. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of files with dangerous types. If exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code execution.

BurgerEditor versions 3.0.0 through 3.4.0 contain an authorization bypass issue through a user-controlled key. If exploited, an attacker who can log in to the product may alter page content.

A cross-site scripting (XSS) vulnerability was found in the Rizwan17 inventory-management-system in the index.php file of the Login Page component. Manipulating the msg argument allows script injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A security vulnerability in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f affects the file includes/invoice_bill.php in the Invoice Generation component, where manipulation of arguments order_date/invoice_no leads to missing authentication, allowing remote attack.

In the inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f, a cross-site scripting vulnerability was found in includes/DBOperation.php of the List Handler component. Manipulation of category_name/brand_name/product_name arguments allows remote attack. The exploit is public, and the project has not responded.

A vulnerability in the Bluetooth Classic (BR/EDR) stack in Zephyr RTOS affects the L2CAP receive handler, which dispatches inbound data PDUs based only on the destination channel ID without verifying that the channel has reached the BT_L2CAP_CONNECTED state. An attacker within radio range can send data to a channel during connection setup, before configuration and authentication complete. This can lead to delivery of attacker data to upper-layer protocols on a half-open channel and to use of stale or partially initialized channel state, causing denial of service or a potential dangling-pointer condition.

Open WebUI from 0.5.0 to 0.11.1 has a vulnerability causing infinite loop in the message-chain reconstruction helper in backend/open_webui/utils/misc.py. An authenticated user can store id-less messages in a cyclic structure, blocking the event loop and growing memory until termination. Fixed in 0.11.1.

Open WebUI from 0.9.5 to 0.11.1 fails to reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled. An authenticated user can redirect fetches to excluded hosts, loopback, private networks, or cloud metadata services, and route content into various features. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 has an infinite loop vulnerability in the chat deletion helper in backend/open_webui/models/chats.py. An authenticated user can create a cyclic chat tree and delete a message, causing a synchronous infinite loop that blocks all user requests until process termination. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 fails to apply folder write-access checks when creating a new chat with a client-supplied folder_id in POST /api/chat/completions and POST /api/v1/chat/completions. An authenticated user who knows a shared folder identifier can inject a chat into a folder where they have read-only or no write access, causing the entry to appear to authorized readers. Fixed in 0.11.1.

Open WebUI from 0.9.5 to 0.11.1 does not verify that the calling user authored the targeted message in the channel branch of chat_completion. A channel member can replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. Fixed in 0.11.1.

Open WebUI from 0.7.0 to 0.11.1 fails to apply metadata filter in the built-in knowledge search tool, allowing an authenticated user to enumerate identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection. Document text remains separate, but metadata is exposed. Fixed in 0.11.1.

In yshopmall version 3.3 and earlier, there is a Cross Site Scripting (XSS) vulnerability. The file upload endpoint /api/upload lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.

In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details and trigger unauthorized workflow executions.

Open WebUI from 0.6.27 to 0.11.1 incorrectly captures a cookie jar in external tools, potentially leaking user session cookies to the operator of another tool server. When multiple tool servers are attached and a session or OAuth connection is processed last, requests to a different server may include the user's Open WebUI session cookies, allowing account takeover. Fixed in 0.11.1.

Open WebUI from 0.9.0 to 0.11.1 fails to invalidate the cached user record after role changes. An administrator demoted through a trusted role header or OAuth role mapping can keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closes. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 allows an authenticated user to place a folder under itself or one of its descendants, creating a cycle in the folder tree. The lack of visited-folder tracking during delete and read operations enables a request that consumes CPU and memory indefinitely until repaired.

Open WebUI from 0.9.0 to 0.11.1 stores the calendar event alert_minutes value without type validation, and the scheduler compares it numerically. An authenticated user with calendar permission can store a non-numeric value that raises an exception and aborts the instance-wide alert pass, suppressing all users' reminders.