CVE Vulnerability Catalog

A potential security vulnerability has been identified in HP ImageDiags for versions prior to 5.0.0.36, which could allow a local attacker to escalate privileges due to insufficient access controls.

Unauthenticated Cross Site Scripting (XSS) vulnerability exists in WordPress Social Login and Register versions up to 7.8.2.

An unauthenticated bypass vulnerability in SiteGround Security versions up to and including 1.6.6.

An unauthenticated broken authentication vulnerability in RegistrationMagic versions up to and including 6.0.9.8.

An unauthenticated Cross Site Scripting (XSS) vulnerability in SliceWP versions up to and including 1.2.10.

An unauthenticated Cross Site Scripting (XSS) vulnerability in RegistrationMagic versions up to and including 6.0.9.8.

In EasyAdmin (an admin generator for Symfony) versions from 4.0.0 to 4.29.16 and 5.5.1, there is a vulnerability where path-based access control can be bypassed. This occurs because the controller swap happens after the firewall check, and the routeName parameter is not validated. A low-privilege user can execute another route's controller if they know its name, bypassing path-based protections. Routes that enforce their own authorization (e.g., via #[IsGranted]) remain protected. The issue is fixed in versions 4.29.16 and 5.5.1.

In elFinder (a web file manager) before version 2.1.70, there is a vulnerability that allows bypassing file type restrictions during archive extraction. The checkExtractItems() function does not normalize the MIME type, so files with extensions .phtml, .phar, .php5, and .php3 can be extracted even if uploadDeny blocks text/x-php. An attacker with ZIP upload permission can place PHP files in a web-accessible directory and achieve remote code execution. The issue is fixed in version 2.1.70.

In elFinder before version 2.1.70, there is a Server-Side Request Forgery (SSRF) vulnerability during URL uploads. When PHP cURL is unavailable, IP validation can be bypassed via DNS rebinding, allowing connections to internal addresses. Additionally, even when using cURL, there is a blind SSRF path. The issue is fixed in version 2.1.70.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Super Store Finder versions up to and including 7.10.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Tailored Tools versions up to and including 3.0.2.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Email Essentials versions up to and including 6.0.6.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector versions up to 4.0.5.

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated Cross Site Scripting (XSS) in Uncode theme versions up to 2.12.7.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.

Subscriber SQL Injection in Charitable versions up to 1.8.12.1.

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.

Kirby is an open-source content management system. Prior to versions 4.9.5 and 5.5.2, the media handler in src/Cms/Media.php allowed Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.