CVE Vulnerability Catalog

The Podlove Podcast Publisher plugin for WordPress up to version 4.5.3 contains an arbitrary file deletion vulnerability. Authenticated attackers with Contributor-level access can delete arbitrary files on the server, potentially leading to remote code execution.

The Platnosci Online Blue Media (Autopay) plugin for WordPress up to version 5.0.0 contains a Stored Cross-Site Scripting (XSS) vulnerability. Unauthenticated attackers can inject arbitrary scripts that will execute on the WooCommerce checkout page.

The Query Wrangler plugin for WordPress up to version 1.5.57 contains a remote code execution vulnerability. Missing capability check and nonce verification in the AJAX handler allow authenticated attackers with Subscriber-level access to execute code on the server.

A SQL injection vulnerability has been found in Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. It affects an unknown function in the file /osrf-gateway-v1 of the open-ils.fielder OpenSRF Service component. The attack can be executed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in the Online Shopping System 1.0 by code-projects. It affects an unknown function in the file /login.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit has been made public.

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image, compressed chunks are decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker can submit a crafted DAA file with highly compressed data, causing excessive memory and CPU consumption, potentially making the extraction worker unresponsive or terminating it, affecting service availability.

SiYuan before v3.7.4 contains an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

A weakness has been identified in Jinher OA 1.0. An unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx is affected. Manipulation of the argument httpOID causes SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used for attacks. The vendor was contacted but did not respond.

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. An unknown function of the file /etc/config/easycwmp is affected. The manipulation results in hard-coded credentials. Remote attack is possible but highly complex and difficult to exploit. The exploit has been released publicly and may be used. The vendor was contacted but did not respond.

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206 involving hard-coded credentials in the /etc/shadow file. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit is publicly available.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0, where SQL injection in /edit_teacher.php via the ID argument can lead to SQL injection. The attack can be performed remotely, and the exploit is publicly disclosed.

In @fastify/multipart, a multipart form-data parser for Fastify, versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects during processing. An unauthenticated client can repeat this to cause persistent disk consumption and denial of service. The issue is fixed in version 10.1.1.

In @fastify/multipart, versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client aborts the connection before sending the terminating boundary, saveRequestFiles() never settles, and the temporary file is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in version 10.1.1.

In @fastify/jwt, a JSON Web Token plugin for Fastify, versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret. Applications using different keys for different authorization domains may accept tokens signed with the global key on routes requiring another key, allowing an ordinary authenticated user to cross a key-based trust boundary. The issue is fixed in version 10.2.2.

A vulnerability in the Linux kernel leads to unbounded recursion in the memory free path of the slab allocator. Cycles between obj_exts arrays of different kmalloc caches can cause stack overflow and system crash.

In the Linux kernel, the Thunderbolt subsystem has a use-after-free vulnerability in XDomain delayed work during disconnect. The tb_xdp_handle_request() function may queue delayed work after tb_xdomain_remove() cancels it synchronously but before the xdomain object is freed, leading to work executing on freed memory. The fix adds an xd->removing flag and synchronization via xd->lock.

In the Linux kernel, the dmaengine idxd driver has a cleanup issue after fdev setup failure in idxd_cdev_open(). The failed_dev_add and failed_dev_name paths drop the file-device reference while holding wq->wq_lock, which can deadlock if put_device() triggers idxd_file_dev_release() trying to reacquire the same lock. Additionally, these paths fall through to later ctx cleanup labels that may operate on freed context. The fix moves idxd_wq_get() before possible failure and unlocks wq->wq_lock before put_device().

In the Linux kernel, a deadlock was found in the btrfs subsystem for zoned filesystems between metadata writeback and transaction commit. The issue occurs when metadata writeback holds the zoned_meta_io_lock and then tries to activate a zone, which requires waiting for a transaction commit that needs the same lock. The fix releases the lock before calling btrfs_zone_finish_one_bg() and re-acquires it afterwards.

In the Linux kernel, the keys subsystem has an out-of-bounds read vulnerability in keyring_get_key_chunk(). For description-level chunks, the read pointer is advanced by level * sizeof(long) past the inline prefix but only the prefix is bounds-checked, allowing reads past the allocated memory for long key descriptions.