CVE Vulnerability Catalog

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant.

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution.

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections.

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media action to write an ERB template into a theme's views directory, which executes when rendered.

The aBlocks plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The endpoint is registered with permission_callback => __return_true and the register() handler reads roleSlug directly from attacker-controlled block attributes without verifying that formType is registration, allowing authenticated attackers with Contributor-level access and above to escalate their role to Editor or another non-administrator role and receive a fully authenticated session at the elevated privilege level.

A broken access control vulnerability in the JiraController component of Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects. The flaw stems from insufficient permission checks.

The WordPress plugin QA Analytics (qa-heatmap-analytics) up to version 5.3.0.1 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject a malicious script that executes in a user's browser.

The WordPress plugin VOD Infomaniak up to version 1.5.14 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject malicious code that is stored and executed by other users.

The WordPress plugin Events Manager up to version 7.4.8 is vulnerable to reflected XSS due to improper neutralization of input during web page generation. An attacker could trick a user into clicking a crafted link, leading to execution of a malicious script.

The WordPress plugin BP Better Messages up to version 3.1.3 is vulnerable to DOM-based XSS due to improper neutralization of input during web page generation. An attacker could exploit DOM manipulation to execute a malicious script in the victim's browser.

The WordPress plugin W3 Total Cache up to version 2.10.7 is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker could inject a malicious script that is stored and executed by users visiting the site.

The WordPress plugin 'We're Open!' (versions up to 2.6) is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the victim's browser.

The WordPress plugin 'WP Event Solution' (versions up to 4.1.26) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder. This allows high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

The Download Monitor WordPress plugin before version 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the [wppb-register] shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).

Craft CMS allows any authenticated control panel user to submit an element-search condition whose selector is evaluated as a sandboxed Twig object template; the allowed column filter delegates property lookup to Yii ArrayHelper outside Twig's SecurityPolicy, bypassing the sandbox to recover GeneralConfig::securityKey and then forge signed parameters that invoke native PHP callables.

The Mollie webhook endpoint accepts two independent attacker-controlled parameters (commerceTransactionHash and id) and never verifies they belong together; an unauthenticated attacker with any paid Mollie payment ID can mark any transaction as paid for its full amount.

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user; a user with only accessCp can place newline characters in X-Craft-Plugin-Licenses, injecting a new attacker-known CRAFT_SECURITY_KEY into .env and forging a signed redirect with a Twig system() callback.

Happy DOM from 17.0.0 until 21.0.4 in ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating it as a JavaScript binding identifier; with enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can cause generated JavaScript to execute in the Node.js host process.