CVE Vulnerability Catalog

In the Kirachon context-engine project up to version 1.9.0, a command injection vulnerability was found in the execGitCommand function in src/mcp/utils/gitUtils.ts of the review-git-diff Endpoint component. Manipulating the args argument allows command execution. Version 1.9.1 contains a fix.

In the MZ Automation libiec61850 library up to version 1.6.1, a heap-based buffer overflow vulnerability was found in the MmsMapping_varAccessSpecToObjectReference function in src/iec61850/common/iec61850_common.c of the MMS Protocol Workflow component. Manipulating the GetNamedVariableListAttributesResponse.itemId argument leads to overflow. The attack requires local access, and the exploit is public.

The AI Engine WordPress plugin before version 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them. This requires a non-default public API feature to be enabled; otherwise the issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read network-shared configuration and secrets.

The AI Engine WordPress plugin before version 3.6.4 does not verify ownership of a guest's uploaded files before deletion, relying solely on a client-supplied session cookie value for authorization. An unauthenticated attacker who obtains a victim's session identifier and file reference can delete the victim's uploaded files.

The Download Monitor WordPress plugin before version 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions and exposes the nonce protecting it to unauthenticated visitors. This allows unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.

The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints. This allows an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

The WP Statistics WordPress plugin before version 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds. This allows users with Subscriber-level access and above to disclose the site's visitor analytics data.

The YMC Filter WordPress plugin before version 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users. Users with the Author role and above can upload a file containing JavaScript that executes in the site's origin when the file is viewed.

The YMC Filter WordPress plugin before version 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved. Users with the Contributor role and above can store JavaScript that executes in the browser of any visitor viewing an affected filter.

The Link Library WordPress plugin before version 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.

The Appointment Hour Booking WordPress plugin before version 1.5.88 does not validate a client-supplied booking price against the server-side configured service price. Unauthenticated users can submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.

The Newsletters WordPress plugin before version 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to and including 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

Klever-Go, the Go implementation of the Klever blockchain protocol, versions prior to 1.7.18 have a resource-exhaustion flaw in account-data trie syncers. Errors on error paths permanently consume throttler slots, potentially causing sync to stop and bootstrap to fail. Fixed in version 1.7.18.

Ruby LSP, an implementation of the language server protocol for Ruby, in the VS Code extension prior to version 0.10.4 has a vulnerability that allows overriding the path to the Ruby executable, version manager executables, or Bundler Gemfile. A malicious repository with a .vscode/settings.json could set these values to attacker-controlled targets, leading to code execution with developer privileges. Fixed in version 0.10.4.

XWiki Platform WebJars API, a package for XWiki, versions from 9.6-rc-1 to 16.10.17, 17.4.9, and 17.10.3 have a path traversal vulnerability that allows an attacker with a malicious WebJar extension installed to write arbitrary files. This requires admin access to a subwiki. Fixed in versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.

Kata Containers before version 4.0.0 has an authorization bypass vulnerability in confidential-guest memory management. Two ttRPC methods introduced with the mem-agent feature lack the AgentPolicy authorization check, allowing an untrusted host to manipulate guest memory when mem-agent is enabled (off by default). The impact is limited to availability and performance degradation, not memory disclosure or code execution.