CVE Vulnerability Catalog

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c). When processing a RAIL PDU header, the code subtracts RAIL_PDU_HEADER_LENGTH from the peer-controlled orderLength field without first verifying orderLength is at least the header length. For orderLength values 0..3 this causes an unsigned integer underflow to a very large size, which bypasses the Stream_EnsureRemainingCapacity() capacity check (due to pointer arithmetic wraparound) and is then passed to WTSVirtualChannelRead(), resulting in an out-of-bounds heap write. A malicious or compromised RDP client can exploit this to corrupt the heap and crash the server. Fixed in FreeRDP 3.29.0.

FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIMIT when processing Transfer-Encoding: chunked HTTP responses in http_response_recv_body(). Attackers controlling a malicious RD Gateway endpoint can send oversized chunked response bodies to exhaust client memory resources without triggering the configured size limit.

FreeRDP before version 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler. A malicious RDP client can send a header-only RDPEI message with a large declared body length, causing excessive memory allocation on the server.

FreeRDP before version 3.29.0 contains a heap out-of-bounds read vulnerability in glyph cache handling. A malicious RDP server can send a crafted fragment with an oversized declared size, causing a client crash.

FreeRDP before version 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can trigger a crash by sending malformed media format data.

FreeRDP before version 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders. When smartcard emulation is enabled, attackers can send crafted requests with a NULL pointer, causing strlen() on NULL and client process termination.

better-auth before version 1.1.20 contains a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can craft malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

The Data::Entropy module for Perl versions before 0.010 fetches remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo sources are accessed over HTTP, and the Data::Entropy::RawSource::RandomOrg integrity check matches any non-empty byte string.

The Pronamic Pay plugin for WordPress is vulnerable to privilege escalation. The `maybe_update_user_role()` function passes a Gravity Forms field value directly to `WP_User::set_role()` without validation, allowing authenticated attackers with Subscriber-level access to change their role to Administrator.

The Kali Forms plugin for WordPress is vulnerable to remote code execution via the `_save_data()` function. Insufficient validation of the `thisPermalink` field allows unauthenticated attackers to pass a controlled string to `call_user_func()`, enabling code execution on the server.

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal. Authenticated attackers with admin-level access can delete arbitrary files on the server, including wp-config.php, by manipulating a database value.

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to stored cross-site scripting via form field values. Unauthenticated attackers can inject arbitrary scripts that execute when a user accesses the page.

The AI Engine – The Chatbot, AI Framework & MCP plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the `reauth_for_authorize` function. Unauthenticated attackers can trick an administrator into clicking a link, allowing creation of a new administrator account with attacker-supplied credentials.

The User Profile Builder WordPress plugin before version 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

The HUSKY WordPress plugin before version 1.4.1 does not sanitize a stored setting value against directory traversal before using it in a file inclusion path, allowing users with shop manager capability to include and execute arbitrary local files. This is triggered on every front-end request, including for unauthenticated visitors.

The Mapster WP Maps WordPress plugin before version 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

The Login & Register Forms WordPress plugin before version 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

The DynamicKit for Elementor WordPress plugin before version 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.

The Chat On Desk Order Notifications WordPress plugin before version 1.0.9 does not verify that the one-time password (OTP) has been validated before processing a password reset request. This allows unauthenticated attackers to reset the password of any user, including administrators, and take over their accounts when SMS OTP password reset is enabled.

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before version 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) against a victim who is induced to send a crafted request.