CVE Vulnerability Catalog

Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall version 26.7.1_1 and earlier, allowing a low privileged attacker to execute JavaScript in the context of another user visiting a specific page or clicking on a specifically crafted link.

Pleasanter fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.

The Meow Apps AI Engine plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects AI Engine from n/a through 3.8.6.

The VillaTheme DEPART plugin contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects DEPART from n/a through 1.0.10.

A vulnerability in the Apache Camel CoAP component allows sensitive information disclosure in error responses. When the CoAP consumer fails to build its response after the route completes, the resulting exception is caught and its message — containing class names, file paths, host names, and connection details — is sent back to the CoAP client as the payload of a 5.00 Internal Server Error response.

A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to version 1.24.0.3 in an unknown function of the Workshop Scenario Loader component. Manipulation leads to deserialization, and the attack can be performed remotely. Upgrading to version 1.24.0.4 fixes the issue.

benotes up to version 2.8.1 contains a Server-Side Request Forgery vulnerability in the getUrlInfo function of app/Http/Controllers/PostController.php, within the Bookmark Metadata Endpoint component. Manipulation of the url argument leads to server-side request forgery.

EasyImage up to version 2.8.7 contains a vulnerability in an unknown function of app/del.php involving improper privilege management. Manipulation of the hash argument can lead to privilege escalation.

A security vulnerability has been detected in GNOME libgsf up to 1.14.60. The impacted element is the function ole_info_read_metabat of the file gsf/gsf-infile-msole.c of the OLE2 Parser component. The manipulation leads to heap-based buffer overflow, and the attack can be initiated remotely.

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers. This allows unauthenticated users to make donations below a form's configured minimum or fixed amount.

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes. This allows unauthenticated attackers to mark arbitrary orders as paid, cancel arbitrary orders, and disclose order details including customer contact information.

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default. This allows unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation. This allows unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default. This allows unauthenticated attackers to mark any pending order as paid and to force any order into a failed status without any secret at all.

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback. This allows unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install. This allows unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.

In NocoDB up to 2026.07.0, the UserRefreshToken.deleteAllUserToken function in /auth/user/signup, part of the PublicApiLimiterGuard component, allows uncontrolled resource allocation. The absence of in-app rate limiting on unauthenticated signup and password-forgot endpoints enables a remote attack of high complexity. The vendor considers the limiter pass-through intentional design and deleted the issue without explanation.

A vulnerability was found in NocoDB up to version 2026.08.0 in an unknown part of the users.service.ts file within the Password-Reset Flow component. The manipulation results in a race condition that can be exploited remotely. The vendor deleted the GitHub issue without explanation and did not respond to disclosure contact.

A vulnerability was found in Z.ai Zcode up to versions 3.14.3/3.15.1 in an unknown functionality of the Sed Command Filter component. The manipulation leads to OS command injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be used.

A security flaw was discovered in GouGuOA up to version 6.1.2 in the chunkUpload function of app/disk/controller/Api.php. Manipulating the file_extension argument results in unrestricted file upload. A public exploit is available and can be used for remote attacks.