CVE Vulnerability Catalog

Sharp and Toshiba Tec MFPs fail to properly authorize requests to directly access certain stored image data.

PaperCut NG/MF has an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can enumerate usernames by measuring response times during login attempts.

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.

Missing Authorization vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects versions through 2.0.15.

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. The attack is possible remotely with high complexity. The exploit has been made public.

A security flaw has been discovered in osCommerce 4.14.63493. Affected is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Manipulation of the argument email_templates_key results in SQL injection. The attack is possible remotely and the exploit has been released.

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes OS command injection. The attack is possible remotely and the exploit has been publicly disclosed. The vendor released a fixed version.

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes.

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on product-attribute REST endpoints. Users with a Dokan vendor account can modify attributes of other vendors' products.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint for bulk order-status changes. Users with a Dokan vendor account can modify the status of any WooCommerce order.

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson via REST API. Users with a Subscriber-level account can disclose the content of arbitrary lessons, including paid course lessons they are not enrolled in and unpublished lessons.

The 'Clearfy Cache' WordPress plugin before version 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.

The 'ProfileGrid' WordPress plugin before version 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.

The Contest Gallery WordPress plugin before version 30.0.7 fails to perform capability or nonce checks in one of its post-deletion handlers, relying only on a coarse role-membership test. This allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.

The Simple Membership WordPress plugin before version 4.7.8 does not sanitize a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard. This allows unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

The Blog Floating Button WordPress plugin through version 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.

The GEO my WP WordPress plugin before version 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions. This allows users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.

The Simply Schedule Appointments WordPress plugin before version 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users. This allows users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.

The SVG Support WordPress plugin before version 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG. This allows a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.