CVE Vulnerability Catalog

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Twig templates, bypassing the config_denied_paths restrictions.

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_directory() and use the allow-listed filepath accessor on Medium objects to read file contents of any file matching configured media extensions that the web server process can access.

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups with private addresses to reach internal network resources.

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation and forge unlimited valid tokens. The implementation is further weakened by a low-entropy session token (rand(1,1e6), ~20 bits) that permits blind brute-force, and by use of loose comparison (==) in token verification, enabling PHP type juggling. Exploitation enables cross-site request forgery against authenticated sessions, including execution of arbitrary SQL queries.

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.

The BetterLinks plugin for WordPress up to version 3.1.0 has an authorization bypass vulnerability, allowing authenticated attackers with subscriber-level access to create arbitrary short URLs with controlled slugs and redirect destinations. Exploitation requires the Fluent Boards plugin to be active and the nonce to be accessible on frontend pages.

The Events Manager plugin for WordPress up to version 7.4.0 is vulnerable to SQL injection via the 'meta_key' parameter in the event/location duplicate action. Attackers with contributor-level access can append additional SQL queries to extract sensitive information from the database.

The WP Courses LMS plugin for WordPress up to version 3.2.29 has an Insecure Direct Object Reference vulnerability via the 'resultID' parameter. Authenticated attackers with custom-level access can read other users' quiz answers and scores by enumerating resultID values.

OpenEXR versions 3.1.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13 have an integer overflow in unpack_sample_table(), leading to a read from an invalid memory address and crash when decoding a crafted deep tiled EXR file.

OpenEXR before versions 3.2.10, 3.3.12, and 3.4.13 has an infinite-loop vulnerability in roundListSizeUp() in SampleCountChannel. Supplying UINT_MAX causes the loop to never exit, leading to application hang (denial of service).

OpenEXR versions 3.4.0-3.4.12 have a NULL pointer dereference in exr_attr_set_bytes(). Supplying a positive hint_length with a NULL type_hint causes a deterministic crash, leading to denial of service.

OpenEXR before versions 3.2.10, 3.3.12, and 3.4.13 has a heap out-of-bounds write in SampleCountChannel::set(). An error in Y coordinate calculation can lead to writes before the buffer, potentially causing memory corruption and crashes.

Faveo Helpdesk up to 2.0.3 has a missing authentication flaw in the post-ticket-reply endpoint (FormController::post_ticket_reply). The attack can be initiated remotely, and the exploit has been published. The project was informed but has not responded.

AutomatorWP versions up to 5.8.3 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.

OpenEXR versions 3.4.0 through 3.4.13 are vulnerable to a crash when decoding crafted HTJ2K-compressed EXR files, due to invalid tile geometry in the OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. Fixed in 3.4.14.

OpenTelemetry-Go versions 0.11.0 through 1.44.0 have a panic vulnerability in the OpenTracing bridge due to an unsynchronized extraBaggageItems map, causing concurrent access issues and denial of service. Fixed in 1.45.0.

Style Kits versions up to 2.6.5 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.