CVE Vulnerability Catalog

Sensitive Data Exposure vulnerability in YITH WooCommerce Zoom Magnifier versions up to 2.52.0 allows an unauthenticated attacker to access sensitive data.

A vulnerability in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin up to version 2.0.14 allows a user with Contributor role to download arbitrary files from the server.

The Ultimate Store Kit Elementor Addons plugin up to version 3.0.5 contains a Broken Access Control vulnerability that allows unauthenticated attackers to access functions without authorization.

A command injection vulnerability was found in NocteDefensor LudusMCP up to version 1.0.24 in the SecretDialog.showSecretDialog function in src/utils/secretDialog.ts, in the get_credential_from_user component. The attack can be launched locally.

A command injection vulnerability was found in LeeSinLiang godot-mcp 0.1.0 in the executeOperation function in src/index.ts, in the create_scene/add_node component. The attack must be launched locally.

The RealHomes Memberships WordPress plugin before version 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package. This allows any authenticated user such as a Subscriber to obtain paid membership packages without paying.

Dell RVTools versions prior to 4.8.1 contain an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.

A command injection vulnerability was found in MissionSquad mcp-api up to version 1.11.8 in the this.packageService.installPackage function in src/controllers/packages.ts, in the NPM Package Version Handler component. The attack can be initiated remotely. Upgrading to version 1.11.9 resolves the issue.

A server-side request forgery (SSRF) vulnerability was found in MissionSquad mcp-api up to version 1.11.9 in an unknown function in src/services/dcrClients.ts. The attack may be performed remotely. Upgrading to version 1.11.10 fixes the issue.

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect overall system availability or the processing of other traffic types, and the process is automatically restarted, and the failure is immediately reported to the user.

Hubzilla versions prior to 11.4 contain a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client.

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. It affects the function ssh_exec in file src/index.ts of the SSH Command Handler component. Manipulation of the host/username argument results in command injection. The attack requires local access. The actual existence of this vulnerability is currently in question. This product uses a rolling release strategy, so version details cannot be specified. The project maintainer explains that the intended threat model is that this MCP server is a local/trusted tool for an agent to execute commands over SSH, so callers already have meaningful execution capability through the exposed shell.

A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. It affects the function screenshotElement in file src/index.ts of the screenshot_element Tool component. Manipulation of the output_name argument leads to path traversal. The attack can be executed remotely. Upgrading to version 1.1.1 addresses this issue. The patch name is 1102172c9adec4a619e241efd6bfb74f5b1f4332. Upgrading the affected component is advised. The vendor was contacted early, responded professionally, and quickly released a fixed version.

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob in file src/WtBtCore/MatchEngine.cpp of the Internal Limit Order Book Cache Handler component. This manipulation causes enforcement of behavioral workflow. Remote exploitation is possible. The exploit has been made public and could be used for attacks. The vendor was contacted early but did not respond.

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal before 1.52.

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.