WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.191 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postcontent' parameter, allowing storage-type cross-site scripting attacks. Authentication attackers with...

tinyhumansai OpenHuman Cross-Site Request Forgery Vulnerability

The tinyhumansai OpenHuman version prior to 0.56.0 has a security vulnerability. This vulnerability stems from an unauthenticated GET /auth/telegram loopback callback, which is vulnerable to cross-site request forgery attacks. The telegramauthhandler consumes a one-time Telegram login token...

The Thecosy IceCms authorization issue vulnerability

The thecosy icecms 4.1.5 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the fact that the /User/ path is excluded from the Shiro jwt filter, resulting in a lack of authentication. Attackers can modify the passwords and roles of any user including...

IBM i Authorization Issues Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have authorization-related vulnerabilities. These vulnerabilities stem from improper execution of the boot version flag, which may allow local attackers to bypass NFS version restrictions...

Cassio Santos Whaticket Open Source: Permissions, licensing, and access control issues

Cassio Santos Whaticket Open Source versions from cf04795 onwards have vulnerabilities related to permission and access control. These vulnerabilities stem from authentication bypasses. Unauthenticated attackers can register as administrators by omitting the profile field or setting it to ‘admin’...

Frappe permissions and access control issues

Versions of Frappe prior to 15.120.0 and versions before 16.33.0 16.x series have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the lack of enforcement of per-user restrictip allowlists for non-session authentication methods, such as API keys,...

WordPress Forminator Forms: Code Injection Vulnerability

WordPress Forminator Forms versions 1.58.1 and earlier have a code injection vulnerability. This vulnerability stems from the forminatorreplacequizformdata function, which calls doshortcode after replacing the quizresult merge tag. Previously, the merged useragent and referurl merge tags retained...

GPAC mp4box security vulnerability

The GPAC mp4box 2.4 version has a security vulnerability. This vulnerability stems from a heap buffer overflow in the stblAddSize function isomedia/stblwrite.c, which could allow attackers to cause a denial-of-service attack by providing specially crafted MP4 files...

AllData authorization issue vulnerability

AllData 0.7.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from unvalidated JDBC injection attacks. Remote attackers can exploit this vulnerability by providing values for jdbcUrl and jdbcDriverClass at the data-dts/jobJdbcDatasource/test endpoint,...

Portable SDK for UPnP Devices – Improper exception handling leads to vulnerabilities

The Portable SDK for UPnP Devices versions prior to 2.0.2 have a vulnerability related to improper exception handling. This vulnerability arises from the ixmlNodecompare function, which directly passes the nullable fields nodeValue, namespaceURI, prefix, and localName to the strcmp function. When...

MZ Automation GmbH libiec61850 Resource Management Error Vulnerability

MZ Automation GmbH’s libiec61850 versions prior to 1.6.2 contain a resource management vulnerability. This vulnerability arises from ReportingRCBWriteAccessHandler accepting an RptID exceeding 129 bytes when writing to the report control block. During report serialization,...

WPEVEREST User Registration PRO – Cross-site Scripting Vulnerability

The WPEVEREST User Registration PRO 6.2.9 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping. It can be exploited through the HTTP Referer header, leading to storage-type cross-site scripting attacks. This...

WordPress 10Web Booster has a path traversal vulnerability

WordPress 10Web Booster versions 2.34.5 and earlier have a path traversal vulnerability. This vulnerability arises from path traversal attacks, as the OptimizerWebPageCache::getcachefiledir function appends unclean $GET parameter names and values to the disk cache path. Additionally, the...

Nezhahq Nezha resource management error vulnerability

Versions of Nezhahq Nezha from 2.0.13 to 2.3.15 have a resource management vulnerability. This vulnerability stems from the lack of restrictions on concurrent connections at the/api/v1/ws/transfer WebSocket endpoint. Authorized attackers can create numerous ServerTransferClass.Subscribe...

Mattermost authorization issue vulnerabilities

Mattermost versions 11.10.0 and earlier of 11.10.x series, 11.7.9 and earlier of 11.7.x series, 11.9.1 and earlier of 11.9.x series, and 11.8.5 and earlier of 11.8.x series have an authorization issue. This issue arises from failing to properly restrict private teams from appearing in public team...

ExtendThemes Image Hub information leakage vulnerability

The extendthemes Image Hub version 1.2.0 and earlier have a vulnerability involving information leakage. This vulnerability stems from the exposure of sensitive information. The vulnerabilities occur when plaintext API credentials for six third-party services are output into the HTML of each...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.0 have a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the persistentcachereadentryv3 function. An attacker can provide a specially crafted v3 persistent cache file. Setting larger width and height values causes the size...

10up Distributor deserialization injection vulnerability

The 10up Distributor versions prior to 2.3.2 have a deserialization injection vulnerability. This vulnerability stems from the setmeta function in includes/utils.php, which performs double deserialization of distributed article metadata. This may allow users at the Contributor level to instantiat...

Huly Platform Authorization Issue Vulnerability

Huly Platform versions 0.7.432 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification. Any authenticated user can merge any number of persons by calling the mergeSpecifiedPersons account RPC, which may allow attackers to take...

GStreamer gst-plugins-good security vulnerability

GStreamer gst-plugins-good versions prior to 1.28.2 have a security vulnerability. This vulnerability stems from the qtdemuxparseuuid function in the isomp4 plugin, which may read data beyond the end of the heap allocation buffer when parsing MP4 files. This could lead to a leak of heap memory...

GStreamer gst-plugins-good buffer error vulnerability

GStreamer’s gst-plugins-good version prior to 1.28.2 has a buffer error vulnerability. This vulnerability stems from the qtdemuxparsechnl function in the isomp4 plugin during MP4 file parsing, which may cause out-of-bounds read access to global arrays, potentially leading to information leakage...

MariaDB Server buffer error vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a buffer error vulnerability. This vulnerability arises from STAsText, when converting deeply nested GeometryCollections, where recursive...

BMC Helix Network Management Authorization Issues Vulnerability

Versions of BMC Helix Network Management prior to 26.3.01 have an authorization issue vulnerability. This vulnerability stems from the bypass of authentication when configuring SAML single-sign-on. Unverified attackers can log in as a local administrator using any password. By submitting an...

WordPress Sunshine Photo Cart authorization issue vulnerability

WordPress Sunshine Photo Cart versions 3.7.4 and earlier have a vulnerability related to authorization. This vulnerability stems from the lack of proper authorization, which may allow attackers to exploit improperly configured access control levels...

BeyondTrust Remote Support Authorization Issues Vulnerability

BeyondTrust Remote Support versions 26.2.3 and earlier have an authorization issue vulnerability. This vulnerability stems from internal components failing to properly verify the origin of the received messages, allowing attackers to execute file operations on the device...

Konstanty Bialkowski libmodplug buffer error vulnerability

Konstanty Bialkowski’s libmodplug versions 0.8.9.1 and earlier have a buffer error vulnerability. This vulnerability stems from the fact that the nPat parameter in the CSoundFile::ReadDSM function is not validated against MAXPATTERNS. Attackers can exploit this vulnerability by providing a...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a stack buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute code via the network...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a security vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute code via the network...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer error vulnerability. This vulnerability stems from an out-of-bounds read in the Microsoft Office Word component, which could allow unauthorized attackers to leak information through the network...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute code via the network...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute arbitrary code through the network...

Apache Airflow Permission Authorization and Access Control Vulnerabilities

Versions of Apache Airflow prior to 0.11.1 have vulnerabilities related to permission granting and access control. This vulnerability stems from the attachteampermissions function in the multi-team configuration, which grants global read access to audit logs for each team role. This could allow...

Dave Nardella Snap7 OFFICIAL Buffer Error Vulnerability

Dave Nardella Snap7 OFFICIAL versions 1.4.3 and earlier contain a buffer error vulnerability. This vulnerability stems from the lack of checking of the DataLength field in TSnap7 OFFICIAL MicroClient::opReadArea. This allows out-of-buffer writing, enabling malicious S7 peers to overflow the clien...

APITable Authorization Issue Vulnerability

APITable 1.14.0-beta and earlier versions have an authorization issue. This vulnerability stems from an authorization bypass, allowing authenticated users to read node descriptions of other spaces by providing a user-controllable nodeId. When a GET request is made to /node/nodeId/description, the...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer overflow vulnerability. This vulnerability stems from a heap buffer overflow in Microsoft Office Word, which may allow unauthorized attackers to execute code via the network...

JetBrains DataloR path traversal vulnerability

Versions of JetBrains DataLore prior to 2026.2.1 have a path traversal vulnerability. This vulnerability stems from unauthenticated path traversal through the report blob endpoint, which may lead to the reading of arbitrary files...

JetBrains Junie CLI software supply chain issue vulnerabilities

Versions of JetBrains Junie CLI prior to version 26.8.3 have vulnerabilities related to the software supply chain. These vulnerabilities stem from misconfigured MCP servers in untrusted projects, which may lead to code execution...

jxxghp MoviePilot prompt injection vulnerability

Jxxghp MoviePilot versions 3.1.5 and earlier have a vulnerability related to prompt injection. This vulnerability arises when tools such as browsewebpage, searchweb, and torrent metadata parser process unreliable content, embedding malicious instructions. These contents are transmitted through...

ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.27 contains a security vulnerability. This vulnerability arises from the ipv4 stack failing to verify the checksum before doing so. Packets with incorrect checksum metadata can cause skbchecksumhelp to corrupt network headers, potentially leading to privilege...

Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from improper authorization in PUT and DELETE requests for the /:lessonId route. Any course member including students can modify the title and stored HTML content of any course, or delete...

Ivanti Connect Secure software supply chain issue vulnerabilities

The Ivanti Connect Secure version 22.8R2.4 has a software supply chain vulnerability. This vulnerability stems from the improper handling of trust in DSCache configuration data by the dsinvoked broker, which may lead to permission escalation to root access...

Kitae Park Mang Board Cross-site Scripting Vulnerability

Kitae Park Mang Board 2.4.0 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'datatype' parameter input and inadequate escaping of output, allowing for storage-type cross-site scripting attacks. Unauthenticated attackers ca...

WordPress YITH WooCommerce Compare: Cross-site Script Vulnerability

WordPress YITH WooCommerce Compare 3.15.0 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation, which may lead to storage-based cross-site scripting attacks...

Microsoft Office PowerPoint buffer error vulnerability

Microsoft Office PowerPoint has a buffer error vulnerability. This vulnerability stems from the possibility of out-of-bounds reading in Microsoft Office PowerPoint, which could allow unauthorized attackers to leak information through the network...

Cole Medin Archon Authorization Issue Vulnerability

Cole Medin Archon versions 0.2.13 to 0.11.1 have an authorization issue vulnerability. This vulnerability stems from the lack of authentication. Unauthenticated attackers can access the control APIs bound to 0.0.0.0/api/, potentially allowing them to execute commands on the host as an Archon user...

Classroomio authorization issue vulnerability

Classroomio versions 1.0.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the Hono API course submission routing. Attackers can send their course ID along with the submission UUID of other courses as a request to the PUT o...

Microsoft Office Word buffer error vulnerability

Microsoft Office Word has a buffer error vulnerability, which stems from a heap buffer overflow. This vulnerability could allow unauthorized attackers to execute code via the network...

zhontai Admin.Core Authorization Vulnerability

The zhontai Admin Core versions 10.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from an authorization bypass mechanism. Attackers can provide record IDs that exceed the allowed range, bypassing DataScope’s restrictions. Attackers who possess user or...

Likeshop authorization issue vulnerability

Likeshop 3.5.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in AfterSale.php and AfterSaleLogic.php. Attackers can access other customers’ after-sales records by providing user IDs, thereby enabling them to read...