CVE Vulnerability Catalog

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration, exposes its data and configuration endpoint without any authentication and permissive CORS. An unauthenticated attacker with network access can read live process values and server configuration.

ANDRITZ HIPASE-250 stores and transmits user passwords in a reversible format instead of a one-way hash. This allows an attacker to recover all stored passwords by reading the credential store or capturing network traffic.

The Realtyna Organic IDX plugin for WordPress up to version 5.3.0 is vulnerable to arbitrary file upload due to missing file validation and insufficient authorization. Authenticated attackers with subscriber-level access can upload arbitrary files, potentially leading to remote code execution.

The Product Feed Manager For WooCommerce WordPress plugin before version 7.6.1 does not properly sanitize and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

The Geeky Bot WordPress plugin before version 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.

The FlxWoo WordPress plugin before version 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid. This allows unauthenticated attackers to complete WooCommerce orders without paying.

The Demi WordPress plugin before version 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection. This allows unauthenticated attackers to download complete backups including the site database and its user password hashes.

The GiveWP WordPress plugin before version 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records. This allows unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

The Frontend Admin by DynamiApps WordPress plugin before version 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the plugin's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that is subsequently executed, allowing arbitrary PHP code to run on the server. On a multisite network, a non-super subsite Administrator can reach host-level code execution.

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection triggered when an administrator later reviews the stored data. With a suitable gadget chain, this could lead to remote code execution.

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.

CodeIgniter prior to version 4.7.4 is vulnerable in the UploadedFile::move() method. Calling it without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory.

ComfyUI prior to version 0.28.0 is vulnerable in folder_paths.get_annotated_filepath and exists_annotated_filepath. They join workflow-controlled filenames to a base directory without containment check, allowing an unauthenticated attacker to craft a POST /prompt request using LoadImage or similar nodes to probe arbitrary host paths and exfiltrate image-format files through /view.

ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the GET /userdata/{file} endpoint. It serves user-controlled HTML and SVG files with extension-derived content types, allowing script execution in the ComfyUI origin and access to API tokens, settings, workflows, and authenticated-equivalent API calls.

ComfyUI prior to version 0.28.0 is vulnerable in the get_model_preview function in app/model_manager.py. It joins an unrestricted filename to a selected model directory without containment check, allowing an unauthenticated attacker to use traversal, absolute paths, or an unbounded path_index to read image-decodable files and enumerate host paths.

ComfyUI prior to version 0.28.0 is vulnerable to stored cross-site scripting (XSS) in the /view endpoint. It serves uploaded SVG files inline because image/svg+xml and related content types were not handled as dangerous, allowing script execution in the ComfyUI origin.