CVE Vulnerability Catalog

UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.

Fortinet FortiOS versions 7.6.0-7.6.6, 7.4 (all), and 7.2 (all) have a vulnerability of resource allocation without limits or throttling, which may allow an attacker to cause denial of service.

Fortinet FortiOS versions 7.6.1-7.6.6 have a stack-based buffer overflow vulnerability (CWE-121) that may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon, but only if the explicit proxy is configured with Kerberos authentication and SOCKS enabled.

Fortinet FortiWeb versions 8.0.0-8.0.2, 7.6.0-7.6.5, 7.4 (all), 7.2 (all), and 7.0 (all) have an incomplete list of disallowed inputs vulnerability, which may allow an attacker to cause improper access control.

Admidio prior to version 5.0.10 has a vulnerability that allows an authenticated member with upload rights on any one folder to permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter, not the file's actual parent folder. The `file_delete` handler only verifies view rights, never upload rights. This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9.

Ultimate POS contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin.

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.

The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.

The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.

The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables. In multi-team mode, a task or DAG from one team could resolve another team's Connection or Variable, obtaining its credentials in full.

The Joomla extension Cotton Cloud before version 2.0.3 has improper ACL implementation, allowing authenticated users to perform file operations (read, delete, overwrite, re-assign permissions) on files owned by other users.

Velociraptor fails to sanitize data when exporting to CSV, which can lead to formula execution by Microsoft Excel during import. Cells starting with certain characters are treated as formulas, allowing arbitrary code execution.

The hunt_delete() VQL function in Velociraptor allows deleting hunts. Velociraptor misapplied the permission check, requiring only COLLECT_CLIENT (usually assigned to the 'investigator' role) instead of the DELETE_RESULTS permission (usually only assigned to administrators).

A double-free flaw was found in 389-ds-base in the get_ldapmessage_controls_ext() function. An unauthenticated remote attacker can trigger it with a single BIND request carrying a critical Session Tracking control, leading to heap corruption and potential denial of service.

Velociraptor allows reading Stacked result sets from the GUI due to incorrect path validation against the prefix deny list. A user with read access to the root org can access result sets from child orgs.

The Joomla extension tabaoca.org - Cotton Cloud before 2.0.2 has improper ACL implementation, allowing unauthenticated users to perform file operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension.

An authenticated attacker with low privileges can access an endpoint in the controller's web interface vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages, limiting impact to the notification functionality.