CVE Vulnerability Catalog

The Tutor LMS WordPress plugin before version 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can read arbitrary files on the server, including files outside the web root. Readable files include the WordPress configuration file, exposing database credentials and authentication keys and salts, allowing authentication cookies to be forged.

The Conekta Payment Gateway WordPress plugin before version 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.

The FiboSearch WordPress plugin before version 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints. This allows unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.

The Post Grid, Slider & Carousel Ultimate WordPress plugin before version 1.8.1 does not sanitize and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen. This allows users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.

The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve the site's Campaign Monitor mailing list catalog, including list IDs and names, which should be restricted to managers.

The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve all ConvertKit form data configured by the site's manager, exposing integration details intended to be restricted to managers.

The Themify Builder plugin for WordPress up to version 7.8.0 is vulnerable to authorization bypass due to improper verification of user permissions. Unauthenticated attackers can modify the stored styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying a post ID and JSON payload.

OliveTin before commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d has a vulnerability that allows arguments whose names start with 'ot_' to bypass the filterToDefinedArgumentsOnly filter. These arguments are not type-checked, are set as environment variables and passed to executed commands, and are also available in the template context.

WeeChat versions 4.3.0 through 4.9.0 have a vulnerability in the WebSocket permessage-deflate decompression function relay_websocket_inflate() in the relay module, which has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.

CKAN MCP Server before version 0.4.106 has an SSRF vulnerability that allows bypassing the IP address filter using hostname aliases such as ip6-localhost, which are not equal to localhost and are not dotted IPv4 or bracketed IPv6 literals. A remote caller can force the server to connect to local or private addresses.

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (`og:title` and `og:description`). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated `<meta>` tags due to missing output encoding. Under certain browser or DOM interaction scenarios, this may lead to stored cross-site scripting (XSS). Version 2.23.0 fixes the issue.

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.