CVE Vulnerability Catalog

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details, including arbitrary user passwords, to a known plugin-configured custom value. This makes it possible for authenticated attackers with subscriber-level access and above to change arbitrary users' email addresses, including administrators, and reset their passwords.

Velociraptor creates notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query that will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free, and the attack may be launched remotely. The exploit has been made public and could be used, and the pull request to fix this issue awaits acceptance.

A vulnerability was detected in Rizwan17 inventory-management-system in the storeCustomerOrderInvoice function of includes/manage.php. Manipulation of the pro_name[] argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.

In Siam Ordering (siam-server) version 1.0.0, there is an authentication bypass vulnerability via a hardcoded master verification code. Remote unauthenticated attackers can log in as any user, merchant, or administrator.

Open WebUI prior to 0.11.1 in POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject.

Open WebUI from 0.10.0 until 0.11.1 in DELETE /api/v1/knowledge/{id}/delete authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable.

Open WebUI from 0.9.6 until 0.11.1 in SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion.

Open WebUI from 0.8.11 until 0.11.1 in src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview.

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file includes/manage.php. The manipulation of the argument update_category/cid/update_brand/update_product leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Open WebUI from 0.6.41 until 0.11.1 in get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected.

A path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT before version 7.10.2 allows Web Users with Secure Folders and Secure Mail permissions to escape their sandboxed home directory and read arbitrary files.

In Open WebUI from 0.9.0 to 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler fetches the OIDC discovery document and signing keys before validating the logout token, causing repeated network fetches and blocking the event loop, enabling a DoS attack on a single-worker instance.

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java).

In alf.io before version 2.0-M5-2605, an improper access control issue allows an organization owner to read system-level configuration secrets through organization/event scoped 'single configuration' endpoints, including the system API key.

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address and erase all stored addresses by iterating the address id via a GET request to /customer/address/delete/id/{id}.

A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access directory information on a vulnerable system, and successful exploitation could allow arbitrary command execution on the underlying operating system.

A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service (DoS) attack, causing instability and performance degradation of the vulnerable CPPM server.

A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an authenticated remote attacker to achieve remote code execution, allowing arbitrary command execution on the underlying operating system.