CVE Vulnerability Catalog

The cowboy HTTP server from version 2.0.0-pre.4 to 2.17.x is vulnerable to memory exhaustion due to unlimited resources. An unauthenticated attacker can send many HTTP/1.1 headers with the same name, causing continuous binary memory growth, potentially exhausting Erlang VM memory.

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.

The Shortcodify plugin for WordPress up to version 1.4.3 is vulnerable to Stored Cross-Site Scripting via the 'name' shortcode attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a page is visited.

The MCP server in alibabacloud-rds-openapi-mcp-server listens on all network interfaces by default, allowing remote attackers to invoke MCP tools without authorization.

The News Theme V8 for WordPress is vulnerable to Reflected XSS. An attacker can inject malicious script via improperly sanitized input.

ELECOM wireless LAN routers and access points are vulnerable to Reflected XSS in the WebUI. This could allow arbitrary script execution in a logged-in user's browser.

The Taskbuilder plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter. Authenticated attackers with subscriber-level access can inject additional SQL queries.

The web UI has a vulnerability due to improper validation of the post-login redirect. An unauthenticated attacker can redirect users to a malicious website.

The GamiPress plugin for WordPress is vulnerable to Stored XSS via the 'heading_size' shortcode attribute. Authenticated attackers with contributor-level access can inject malicious scripts.

The SMS Alert plugin for WordPress is vulnerable to SQL Injection via the 'checkout_payment_plans' and 'order_status' settings. Authenticated attackers with admin access can inject SQL queries.

The SMS Alert plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter. Authenticated attackers with admin access can inject SQL queries.

The SMS Alert plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter. Authenticated attackers with admin access can inject SQL queries.

In Bouncy Castle for Java (versions 1.73 to 1.78), three ML-KEM (CRYSTALS-Kyber) routines divide polynomial coefficients by the modulus q, allowing an attacker who measures the timing of many decapsulations with the same private key to recover that key. This affects Poly.toMsg (KyberSlash1) and ciphertext compression functions (KyberSlash2).

The Chaty Pro plugin for WordPress is vulnerable to time-based blind SQL Injection. Authenticated attackers with subscriber-level access can inject arbitrary SQL commands.

The ShopLentor plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter. Authenticated attackers with admin access can inject SQL queries.

The ShopLentor plugin for WordPress up to version 3.4.5 is vulnerable to Insecure Direct Object Reference via the 'optionSection' parameter. Authenticated attackers with contributor-level access or higher can read arbitrary WordPress option rows, including internal plugin news feed data, WooCommerce block pattern transients, and third-party configuration records stored as arrays-of-arrays with 'title' keys.

The Advanced Form Integration plugin for WordPress up to version 2.6.0 fails to properly verify user authorization. Authenticated attackers with subscriber-level access or higher can overwrite stored MailUp OAuth tokens in the adfoin_mailup_keys option, hijacking form submission data to an attacker-controlled MailUp account or breaking the integration entirely.

The Cookie Banner plugin for WordPress up to version 4.3.7 is vulnerable to Cross-Site Request Forgery in the process_bulk_action function due to missing nonce validation. Unauthenticated attackers can permanently delete or forcibly resolve GDPR data request records stored in the wpl_data_req table by tricking a site administrator into clicking a link.

The Demi plugin for WordPress up to version 0.0.8 allows unauthenticated attackers to copy arbitrary files on the server via the handle_restore_step function. Lack of access controls on the wp-content/uploads/demi-backup-state/ directory exposes the restore key used to authenticate the unauthenticated AJAX handler. The attack requires a prior restore operation to have been initiated.

The FluentCart WordPress plugin before version 1.4.0 does not verify that a subscription belongs to the requesting customer in several payment-method endpoints. This allows any authenticated customer to act on another customer's subscription (changing payment method, cancelling, or re-binding it) when they know the target subscription identifier.