CVE Vulnerability Catalog

In the nanoid (Nano ID) library before version 5.1.6, there is an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread.

Joomla Extension - balbooa.com - contains a stored cross-site scripting vulnerability via a comment avatar in Gridbox before version 2.20.2.

Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various unauthenticated file system disclosure vectors.

Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has a payment bypass vulnerability.

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

@fastify/forwarded before version 3.0.2 incorrectly parses the X-Forwarded-For header when it contains two or more comma-separated entries. The parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both space and tab. As a result, an entry padded with a tab keeps the literal tab in the resolved address string, which can evade security decisions based on exact string matching, such as allowlists, blocklists, per-IP rate limit keys, or audit log correlation.

Authorization bypass in the emergency recovery approval component of Ente Museum Server. An authenticated attacker configured as a victim's emergency contact can bypass the configured recovery waiting period and take over the victim's account via a crafted `approve-recovery` API request.

Joomla Extension - rolandd.com - contains XSS vectors in AJAX endpoint handlers in RO CSVI before version 9.11.0.

Vulnerability in the Joomla Content Editor (JCE) extension versions prior to 2.20.2. Improper input validation in the file rename function allows an authenticated user with file management permissions to rename files to invalid names, resulting in hidden file creation and unintended overwriting of existing files.

A Path Traversal vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in the administration panel allows for Blind SQL Injection attacks. The vendor states that remediation was not deemed necessary due to the trust model.

The Booking System Trafft plugin for WordPress is vulnerable to Stored XSS via the `bookingWebsiteUrl` setting. A missing capability check on the `set_options` AJAX action allows authenticated users (Subscriber and above) to change this setting, causing a script from an external source to be loaded on pages with the booking shortcode. Affects versions up to 1.0.17.

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'text' attribute of the `wpcbm_best_seller` shortcode. Insufficient input sanitization and output escaping allow authenticated users (Contributor and above) to inject arbitrary JavaScript. Affects versions up to 3.1.6.

The WP CTA plugin for WordPress is vulnerable to SSRF via the 'sticky_s_media' parameter in imported JSON files. The import_sidebars() function passes URLs from JSON to file_get_contents() with FILTER_VALIDATE_URL validation, which allows internal IPs. An authenticated administrator can make requests to arbitrary locations, including internal services. Affects versions up to 2.1.2.

The MasterStudy LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference in the stm_lms_delete_cover() function. Lack of ownership validation on the file_id parameter before calling wp_delete_attachment() allows authenticated users (Instructor and above) to delete arbitrary attachments of other users by enumerating IDs. Affects versions up to 3.7.14.

GNU Bison improperly handles grammar-defined output paths. Directives %output and %header allow arbitrary file paths, which are accepted without restriction, potentially overwriting files. Confirmed vulnerable in version 3.8.2, other versions may also be affected.

diff‑so‑fancy does not properly sanitize non-SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized. An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing.

The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in all versions up to, and including, 1.1.0. This allows unauthenticated attackers to update the plugin's settings, including the Klubraum API token and introduction text, effectively hijacking the plugin's integration with the Klubraum service.

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.