CVE Vulnerability Catalog

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration.

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.3.0. The process_paypal_callback function accepts a base64-encoded paypal_param GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing login as any existing user, including administrators.

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to and including 2.3.0. The revert_switch handler trusts the attacker-controlled original_user_id cookie as the privileged identity, and the nonce and capability check is performed on that cookie instead of the actual requester.

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path could cause clients to accept an unauthorized member into the end-to-end encrypted media session.

In 389-ds-base, the server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS. An on-path attacker can inject a crafted LDAP message that is processed after the TLS upgrade, and the response is delivered to the client instead of the client's own pending operation's response.

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. They can poison segment descriptors or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. They can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.

A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

Code Injection vulnerability in langflow up to 1.9.3. An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which executes code without sandboxing.

Path traversal vulnerability in the /knowledge_base/upload_temp_docs endpoint in Langchain Chatchat 0.3.1. An attacker can write files to arbitrary locations on the server using malicious filenames, bypassing temporary directory restrictions.

Path traversal vulnerability in knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0 and 0.3.1. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write knowledge base content outside the configured root directory.

Path traversal vulnerability in the OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0. An attacker can write files to arbitrary locations outside the `openai_files` directory using malicious filenames.

Code injection vulnerability in deeptutor 1.4.0 in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute chosen shell commands in the service environment.

Path traversal vulnerability in deeptutor 1.4.0 in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace.

Authorization bypass vulnerability in deeptutor 1.4.0 in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.

Authorization bypass vulnerability in DeepTutor 1.4.0 in the book confirmation flow. An unauthenticated or unauthorized caller can reuse a publicly exposed book_id to submit a confirm-proposal request for an existing book, causing unauthorized overwrites of persisted metadata and spine content.