CVE Vulnerability Catalog

Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain access-device policy and client state information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDeviceInfo function of TOTOLINK T6 allows unauthenticated attackers to obtain device identification details via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the RebootSystem function of TOTOLINK T6 allows unauthenticated attackers to arbitrarily force an immediate reboot via a crafted POST request to /cgi-bin/cstecgi.cgi.

A vulnerability in BitChat for iOS version 1.15.0 allows a remote attacker to cause a denial of service (DoS) by sending an unauthenticated MESSAGE packet into the mesh gossip cache.

A Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before version 1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record.

The WordPress plugin (Spiffy Plugin) before version 5.0.9 is affected by Stored Cross-Site Scripting in the Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect users to a malicious site or control the account.

The WordPress plugin (Bit Assist) before version 1.7.2 is affected by Stored Cross-Site Scripting in the Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect users to a malicious site or control the account.

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

The Forminator plugin in versions 1.57.1 and earlier contains an unauthenticated other vulnerability type. An attacker without authentication can exploit this flaw.

The Medical Practice Management System developed by Le-yan has a sensitive data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.

The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for subscribers. Subscriber-level users can gain unauthorized access to administrative functions.

The WpEvently plugin in versions 5.5.0 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.

wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, so every AES-CCM record within a connection is encrypted under an identical key and nonce pair. Reusing a CCM key and nonce weakens confidentiality (identical keystream across records, so a known record recovers the others) and integrity (authentication tag forgery). Only wolfEngine is affected; wolfProvider is not. AES-GCM under wolfEngine is tracked separately. AES-CCM cipher suites are not enabled by default and must be explicitly selected, which limits exposure. TLS 1.3 and non-TLS use of the cipher are not affected.

The WP Job Portal plugin in versions 2.5.9 and earlier has an Insecure Direct Object References (IDOR) vulnerability for subscribers. Subscriber-level users can access objects (e.g., data) without authorization.

The ACF Extended plugin in versions 0.9.2.6 and earlier has a Broken Access Control vulnerability for contributors. Contributor-level users can gain unauthorized access to administrative functions.

Uncontrolled recursion in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. The issue stems from misclassification of a list as a charlist, leading to recursive exception raising and stack growth until memory exhaustion.

Ceviz Informatics Inc. Web Design has a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions through 25082026.