CVE Vulnerability Catalog

Editor PHP Object Injection vulnerability in Fluent Boards Pro versions up to 2.0.11. A user with editor role can inject malicious PHP objects, potentially leading to remote code execution.

Editor Privilege Escalation vulnerability in FluentCRM Pro versions up to 3.1.12. A user with editor role can escalate their privileges to administrator level.

Unauthenticated XSS vulnerability in Realtyna Organic IDX plugin versions up to 5.4.1. An attacker can inject malicious script that executes in the victim's browser.

The Booking and Rental Manager plugin for WordPress versions up to 2.7.5 contains a PHP Object Injection vulnerability exploitable by users with the Contributor role.

Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.

Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.

Apache APISIX versions 2.12.0 through 3.17.0 are vulnerable to HTTP Request/Response Smuggling. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.

The ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63 contains a SQL Injection vulnerability exploitable by users with the Subscriber role.

The Kadence Shop Kit plugin for WordPress versions up to 3.0.6 contains a SQL Injection vulnerability exploitable by users with the Subscriber role.

The Mobile App for WooCommerce plugin for WordPress versions up to 0.4.62 contains an unauthenticated Broken Access Control vulnerability.

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it. Users with a role as low as subscriber can read arbitrary files on the server, including its configuration file and authentication secrets.

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Affected versions: Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19.

A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Affected versions: Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.0.RELEASE-5.2.25.RELEASE.

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. This affects a wide range of Spring Framework versions.

The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. This affects Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, and 6.1.0-6.1.28.

Spring Cloud Gateway versions 5.0.0-5.0.2, 4.3.0-4.3.5, 4.0.0-4.2.9, and 3.1.13 and earlier are vulnerable in JsonToGrpcGatewayFilterFactory, allowing arbitrary Spring Resource locations for defining the proto descriptor.