CVE Vulnerability Catalog

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers, allowing unauthenticated attackers to change order status and overwrite payment metadata.

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.

The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the public-facing form, allowing high-privilege users (such as administrators, who do not hold the unfiltered_html capability on multisite) to store JavaScript that executes in the browser of any visitor who views the form.

The SureForms plugin for WordPress up to version 2.8.1 has a Stored Cross-Site Scripting vulnerability via the 'headingWrapper' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts.

The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.9 has a blind SQL Injection vulnerability via the 'field' parameter due to insufficient escaping and query preparation. Authenticated attackers with administrator access can append additional SQL queries and extract sensitive data from the database.

The SendPulse Email Marketing Newsletter plugin for WordPress up to version 2.2.5 has a Stored Cross-Site Scripting vulnerability via the _sp_form_code Post Meta field due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary scripts, bypassing the allow-list check.

In the pion/stun library (Go STUN implementation) before version 3.1.3, parsing a malformed XOR-MAPPED-ADDRESS attribute can cause a panic, leading to remote denial of service.

In gemini-bridge (MCP server bridging AI agents to Gemini AI) versions 1.0.0 to 1.3.1, the consult_gemini_with_files function in inline mode reads any file path supplied without confining to the working directory, forwarding contents to Gemini CLI, allowing arbitrary local file read.

In WPGraphQL for WordPress versions 2.0.0 to 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts and obtain public profile fields.

In GeoNetwork versions 3.12.0 to 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login.

In Decidim before versions 0.30.9, 0.31.5, and 0.32.0.rc2, the download_your_data flow requires authentication but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it.

In Decidim before versions 0.30.9, 0.31.5, and 0.32.0.rc2, the GET /admin/organization/users search interpolates params[:term] into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated organization administrator to execute blind PostgreSQL expressions and infer data through timing differences.

In Decidim before versions 0.30.9, 0.31.5, and 0.32.0.rc2, the identity-document verification admin controllers load pending Authorization records by raw identifier without confirming current_organization ownership, allowing an administrator from one tenant to view, approve, or reject another tenant’s ID-document request.

xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.

FS Inc S3150-8T2F Switch version 2.2.0D Build 118101 contains a reflected XSS vulnerability in the /logo.asp component. Attackers can execute arbitrary JavaScript in the victim's browser via a crafted URL.

In Decidim versions 0.31.1 through 0.31.4 and 0.32.0.rc1, a regular participant can access the demographics questionnaire editor at /admin/demographics/questions/edit_questions without required administrator authorization. The route lacks an admin permission check.

In Jodit Editor prior to version 4.13.6, the clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element to remain in editor.value and execute when content is loaded.

In Jodit Editor prior to version 4.12.31, the sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering. A victim clicking a stored link can execute attacker-controlled script.

In free5GC prior to version 1.4.5, the AUSF does not validate the supiOrSuci field in UE authentication requests. Null bytes and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go's net/url.Parse() to fail and return HTTP 500 with stack trace leakage. An unauthenticated attacker can cause denial of service for all subscribers attempting authentication through the affected AUSF.

In NTPsec, a buffer overflow in the Zyfer reference clock driver allows a local attacker to crash the ntpd process.