CVE Vulnerability Catalog

In the Linux kernel, the brcmfmac driver has a vulnerability where the bus_reset work item is not drained on device removal, leading to a use-after-free when the work callback runs after the drvr structure is freed.

In the Linux kernel's esd_usb CAN driver, there is a vulnerability where anchored URBs are not killed before freeing netdevs. This causes a use-after-free during device disconnect, as private data is freed before attempting to kill the URBs.

In the Linux kernel's USB gadget f_midi driver, a use-after-free vulnerability exists because the midi->work work item is not canceled before the f_midi object is freed. This allows the work handler to run after memory has been released. The issue was found by an in-house static analysis tool.

In the Broadcom BDC UDC driver in the Linux kernel, there is a use-after-free and NULL pointer dereference vulnerability. Interrupt handling and delayed work can execute after memory structures are freed during driver removal, potentially leading to system crash or code execution.

A SQL injection vulnerability was detected in SourceCodester Computer Repair Shop Management System 1.0 in /classes/Master.php?f=delete_product. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely.

A vulnerability was detected in TinyAGI 0.0.20 in the processMessage function of packages/main/src/index.ts in the Message API Endpoint component. Missing authorization allows remote attack. The exploit is public, and the project has not responded.

A vulnerability was found in TinyAGI 0.0.20 in the collectFiles function of packages/core/src/response.ts in the Message API Endpoint component. This manipulation causes file inclusion. The attack can be initiated remotely, and the exploit is public.

In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.2.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Events Manager WordPress plugin before version 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the plugin then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information. This allows unauthenticated attackers to deactivate the plugin's premium licensing state and erase the stored license key.

The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes. This allows unauthenticated users to read published entries of custom post types that the site registered as non-public.

The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response. This allows unauthenticated users to read the lifetime number of units sold for any published product.

A vulnerability was identified in JeecgBoot up to 3.9.2 in an unknown function of the file /airag/chat/send of the Anonymous Chat Attachment Parser component, allowing server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 5.0.0. On sites not connected to the WPMU DEV Hub, the API key is empty, making the signature trivially forgeable; version 5.0.0 also removed the replay check. This allows unauthenticated attackers to invoke privileged actions, including installing plugins from attacker-supplied URLs (leading to RCE), deleting plugins, upgrading WordPress, or logging in as admin.

The Forminator Forms plugin for WordPress up to version 1.56.1 is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The FluentSMTP plugin for WordPress up to version 2.2.95 is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator accesses the detail view of logs.