CVE Vulnerability Catalog

The Subscriptions for WooCommerce plugin for WordPress (all versions up to and including 2.0.0) fails to properly verify user authorization in the wps_sfw_install_plugin_configuration AJAX handler, allowing authenticated attackers with shop manager-level access or higher to install and activate arbitrary WordPress.org plugins.

Improper input validation in the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges, resulting in unrestricted access to the device.

Improper input validation in the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain privileged user access to the device.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its unverified `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash into different hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` to connect to an arbitrary attacker-chosen host.

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled, an unauthenticated attacker can perform a Denial-of-Service attack.

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

An unauthenticated remote attacker can force the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

A vulnerability in multiple Mitsubishi Electric products (including MELSEC MX controllers, CC-Link IE TSN modules, MELSERVO servos, and FR-A800/F800/E800/D800 inverters) involves improper enforcement of message integrity during transmission in a communication channel. An attacker with access to a CC-Link IE TSN network can tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could cause a denial-of-service (DoS) condition by interfering with the control function or causing incorrect operation.

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. An attacker with access to one path can abuse boundary handling to read or write paths outside the intended filesystem allowlist. This affects Node.js main, 22.x, 24.x, and 26.x.

When enabling Spring Boot DevTools support for a remote application target from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affects Spring Tools for Eclipse 5.2.0 and earlier.