Parse Platform Parse Server Authorization Vulnerability

The Parse Platform, versions prior to 8.6.93 and 9.0.0 up to 9.10.1-alpha.13, have an authorization issue vulnerability. This vulnerability stems from the lack of enforcing the identity scope’s protectedFields during count queries using the $relatedTo operator. As a result, the size of the...

Jakub Vrána Adminer code injection vulnerability

Jakub Vrána’s versions prior to 6.1.1 have a code injection vulnerability. This vulnerability arises because authenticated SQLite users can bypass the ATTACH and VACUUM INTO restrictions by adding UTF-8 byte-order marks before the SQL statements. This could allow attackers to attach database file...

Parse Platform Parse Server Improper Exception Handling Vulnerability

The Parse Platform and Parse Server versions prior to 8.6.95, as well as versions from 9.0.0 to 9.10.2-alpha.3, have a vulnerability related to improper exception handling. This vulnerability arises from the lack of parsing of URL references in files when objects are passed to Cloud Code triggers...

Karuppiah Natarajan – Easy-PDF-Merge command injection vulnerability

Karuppiah Natarajan’s easy-pdf-merge tool versions from 0.1.0 to 0.2.6 and earlier contain a command injection vulnerability. This vulnerability stems from an OS command injection issue. Attackers can inject shell metacharacters into the source path, target path, or maxHeap option. By passing fil...

MikroTik RouterOS Authorization Issues Vulnerability

MikroTik RouterOS versions 7.0.0 to 7.24.5 have a vulnerability related to authorization. This vulnerability stems from improper authorization checks in the WinBox authentication process. Remotely authenticated users with low privileges can obtain full management access by specifying a...

Luke Jackson Servør path traversal vulnerability

Luke Jackson Servo versions 1.0.0 to 4.0.2 and earlier have a path traversal vulnerability. This vulnerability arises from the fact that decodeURI is executed before path.join in serveStaticFile and serveDirectoryListing. Attackers can send URL-encoded strings to escape the root directory, making...

WordPress Event Post Authorization Issue Vulnerability

WordPress Event post 6.1.1 and earlier versions have a vulnerability related to authorization settings. This vulnerability stems from improper access control configurations, which may allow unauthorized access...

WordPress Ad Inserter Cross-Site Script Vulnerability

WordPress Ad Inserter 2.8.18 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to stored-xss attacks...

SBABIC SWUpdate encryption vulnerability

The SBABIC SWUpdate 2026.05.1 and earlier versions have a cryptographic vulnerability. This vulnerability stems from improper certificate verification in the crypto/swupdatecmsverifyopenssl.c file. Trusted X.509 certificates that are embedded in CMS SignedData are used to build the certificate...

Ministry of Justice General Directorate of Information Technology UYAP Document Editor Serialization Injection Vulnerability

The Ministry of Justice’s General Directorate of Information Technology has vulnerabilities related to deserialization injection in versions prior to UYAP Document Editor 5.4.20. These vulnerabilities stem from improper handling of deserialized untrusted data, which may lead to object injection...

WordPress Booster Elite for WooCommerce has a vulnerability related to information leakage

WordPress Booster Elite for WooCommerce versions prior to 8.4.0 have a vulnerability related to information leakage. This vulnerability arises from inserting sensitive information into the data sent out, potentially allowing the retrieval of embedded sensitive data...

Plastic Labs’ CEO authorization issue vulnerability

Plastic Labs versions 3.3.0 and earlier have an authorization issue. This vulnerability stems from improper authorization handling; the getorcreateworkspace function only checks the workspace declaration. As a result, holders of API keys with per-app or session scope can access workspace data...

openspug Spug command injection vulnerability

Openspug Spug versions 3.0, 3.1, 3.2, 3.3, 3.4.0, 4.0.0, and 4.0.1 have command injection vulnerabilities. These vulnerabilities stem from the unknown functions of the File Transfer component, which fail to properly validate inputs when executing operations related to the /exec/transfer function...

JupyterHub processing logic vulnerability

JupyterHub 6.0.1 and earlier versions have a processing logic vulnerability caused by identifier conflicts. Users who have been authenticated can override another user’s named server OAuth client by using hyphenated usernames. For example, a user with the username “alice-prod” can override the...

Hatchet Resource Management Error Vulnerability

Hatchet versions 0.110.5 and earlier have a resource management vulnerability. This vulnerability stems from unlimited resource allocation. Unauthenticated attackers can send arbitrary or concurrent request bodies via the SNS ingestion endpoint to POST /api/v1/sns/tenant/event. The SnsUpdate...

Konstanty Bialkowski libmodplug resource management error vulnerability

The Konstanty Bialkowski libmodplug versions 0.8.9.0 and 0.8.9.1 have a resource management vulnerability. This vulnerability arises from manipulation of the abcaddgchord function in the file src/loadabc.cpp within the ABC Music Format Parser component, resulting in excessive resource consumption...

Hyper-MCP race condition issue

Hyper-MCP versions 0.8.3 and earlier have a vulnerability due to a race condition. This issue arises because the loadwasm function in src/wasm/oci.rs verifies the Cosign signature of individual tags, rather than the signature of the loaded manifests. An attacker can control the registry responses...

Mina Saad pbi-cli command injection vulnerability

Mina Saad’s pbi-cli version 3.10.1 to 3.12.0 has a command injection vulnerability. This vulnerability stems from the use of desktopsync.py, which passes unquoted .pbip paths to the cmd /c start command. This makes it vulnerable to OS command injection attacks. An attacker can induce victims to...

openagents-org openagents Authorization Issue Vulnerability

openagents-org has an authorization issue. This vulnerability stems from the lack of authentication for the GET /v1/workspaces interface, allowing unauthenticated attackers to list all workspaces. This may lead to the reading of sensitive information such as the unmasked browserfabricapikey, as...

Highwarden Super Store Finder has a vulnerability in input validation.

Highwarden Super Store Finder versions 3.8 and earlier have a security vulnerability. This vulnerability stems from incorrect handling of the parameters lat/lng in the file /products/superstorefinder/index.php, which may lead to SQL injection attacks...

WordPress MultiVendorX Authorization Issues Vulnerability

WordPress MultiVendorX 5.0.19 and earlier versions have a vulnerability related to authorization. This vulnerability arises from improper authorization settings. Attackers with the storeowner role can send POST requests via the settings REST endpoint, limited only by the editstores permission,...

Hyper-MCP encryption issue vulnerabilities

Hyper-MCP versions 0.8.3 and earlier have an encryption-related vulnerability. This vulnerability stems from the fact that cosignverifyargs accepts any signer identity and OIDC issuer by default. Improper signature verification may allow attackers to load malicious WebAssembly plugins, which can...

OpenDocMan resource management error vulnerability

Versions of OpenDocMan from 2.4.0 to 2.10.0 have a resource management vulnerability. This vulnerability stems from a decompression bomb issue. Certified users can exploit this vulnerability by uploading specially crafted ODT, DOCX, or XLSX files. The XML entries in these files will be decompress...

Studio Saelix Sencho authorization issue vulnerability

The Studio Saelix sencho 0.94.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the improper handling of the X-Forwarded-For parameter in the Login Endpoint component’s file/api/auth/login, resulting in improper authentication. A remote attacker could...

Everyone’s AI MoAI-ADK backend link vulnerability

The All-Users AI MoAI-ADK 3.1.2 and earlier versions have a post-link vulnerability. This vulnerability stems from improper link resolution in the moai init template deployer. Attackers can use symbolic links to the.moai-tmp temporary path to overwrite files outside of the project, causing...

Leo open-computer-use: Input validation error vulnerability

Leo’s open-computer-use software versions 1.0.0 and earlier contain a vulnerability related to input validation. This vulnerability stems from improper handling of case sensitivity, which could allow local MCP callers to bypass the password manager’s rejection list by using case-variant bundle...

TOZED X300 Command Injection Vulnerability

The TOZED X300 versions 6.01.3 and earlier have a command injection vulnerability. This vulnerability stems from the incorrect handling of the Host parameter in the processping function of the IPPingDiagnostics Handler component, which may lead to remote OS command injection...

Lippu Docx Reader Office Viewer App path traversal vulnerability

The Lippu Docx Reader Office Viewer App versions 1.4.5 and earlier have a path traversal vulnerability. This vulnerability arises from the operation on the parameter displayname in the function word.office.docxviewer.document.docx.reader.ViewTxt, which allows for path traversal. Attackers can...

TJ Sweet NornicDB Authorization Issue Vulnerability

TJ Sweet NornicDB versions 1.4.1 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification, which may allow authenticated users to bypass the database-read restriction on the /nornicdb/search and /nornicdb/similar endpoints, thereby...

Frank Fiegel mcp-remote encryption vulnerability

Frank Fiegel’s mcp-remote software, versions 0.8.0 to 0.14.3, has encryption-related vulnerabilities. This issue arises from the fact that authorizeWithDeviceCode does not enforce the use of an HTTPS endpoint. When device authorization and token endpoints are non-loopback HTTP URLs, the client ke...

WordPress Contact Form 7 has a vulnerability related to information leakage.

WordPress Contact Form 7 versions 5.0.7 and earlier have a vulnerability that leads to information leakage. This vulnerability occurs due to the exposure of sensitive data without authentication, which may result in the disclosure of sensitive information...

WordPress JetFormBuilder cross-site scripting vulnerabilities

WordPress JetFormBuilder 3.6.6 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of query variable name parameters that match the preset queryVar settings, as well as inadequate output escaping. This can lead to reflective DOM...

Qode Real Estate cross-site scripting vulnerability

Qode Real Estate versions 1.1.7.3 and earlier have a cross-site scripting vulnerability, which stems from unauthenticated cross-site scripting attacks...

WordPress Payment Plugins for Stripe: WooCommerce Cross-Site Script Vulnerabilities

WordPress payment plugins for Stripe and WooCommerce versions 4.0.17 and earlier have a cross-site scripting vulnerability. This vulnerability stems from the use of the “response” URL fragment to trigger reflective cross-site scripting. The issue arises due to improper input cleaning and output...

WordPress PeproDev Ultimate Profile Solutions Cross-Site Script Vulnerabilities

WordPress PeproDev Ultimate Profile Solutions versions 8.2.36 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and output escaping of the button attribute in the logout-url shortcode, allowing authenticated attackers to inject arbitrary...

Kortix server-side request forgeing vulnerability

Kortix has a vulnerability related to server-side request forgery. This vulnerability arises from the isPrivateIp protection, which can be bypassed using IPv6 6to4 or Teredo addresses. An attacker with the permission of project.connector.write can set the baseurl, OpenAPI, Postman, or MCP URL of...

WordPress SpeedyCache information leakage vulnerability

WordPress SpeedyCache 1.4.2 and earlier versions have a vulnerability related to information leakage. This vulnerability arises from improper handling of the 'commentauthor' and 'commentauthoremail' parameters. The writing path lacks checks for the 'commentauthor' cookie, allowing malicious...

OpenLIT authorization issue vulnerabilities

OpenLIT 2.1.0 version has an authorization issue vulnerability. This vulnerability arises from bypassing authorizations by using a forged x-OpenLIT-project-id header. As a result, authenticated users may access telemetry data from other projects, including LLM prompts and completion content...

Mymoun Backhoe Code Injection Vulnerability

The Mymoun Backhoe 2.0 and earlier versions have a code injection vulnerability, which stems from unvalidated local file inclusion...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...

WordPress Academy LMS has vulnerabilities related to permissions and access control systems.

WordPress Academy LMS versions 4.0.3 and earlier have vulnerabilities related to permission permissions and access control. These vulnerabilities arise from the addchild function, which calls addrole'academystudent' on existing accounts before Store::link verifies the guardianship relationship...

WordPress PayPal deserialization injection vulnerability

WordPress Payee versions 4.8.2 and earlier have a deserialization injection vulnerability. This vulnerability stems from unvalidated PHP object injections, which may lead to remote code execution...

WordPress GeoDirectory code injection vulnerability

WordPress GeoDirectory 2.8.187 and earlier versions have a code injection vulnerability. This vulnerability stems from the designtype parameter, which involves local file inclusion. It may allow unauthenticated attackers to include and execute any.php file on the server, thereby bypassing access...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

Mikado-Themes TouchUp Code Injection Vulnerability

Mikado-Themes versions prior to 1.4 have a code injection vulnerability. This vulnerability stems from unvalidated local file inclusions, which may allow attackers to access local files...

WordPress Advanced IP Blocker authorization issue vulnerability

WordPress Advanced IP Blocker versions 8.13.13 and earlier have a licensing issue vulnerability. This vulnerability stems from the handleloginaction function, which processes the second-step TOTP submission without verifying that the requester has completed the first step of password authenticati...

WordPress Fastcache by Host.it: Code injection vulnerability

WordPress Fastcache by Host.it 1.7.4 and earlier versions have a code injection vulnerability. This vulnerability arises from the lack of cleanup when registering settings using the fastcachesettingscachecookieexclude parameter. Additionally, buildSiteHtaccessRules only uses trim to process cooki...

WordPress ai-copilot-content-generator: Permissions, licensing, and access control issues

WordPress ai-copilot-content-generator versions 1.5.9 and earlier have vulnerabilities related to permission escalation and access control. These vulnerabilities stem from issues with permission elevation, which may allow subscribers to elevate their own permissions...

WordPress ACF Frontend Admin by DynamiApps: SQL Injection Vulnerability

WordPress ACF Frontend Admin by DynamiApps version 3.29.13 and earlier has an SQL injection vulnerability. This vulnerability can be exploited by attackers with administrator privileges, allowing them to execute SQL injections and potentially lead to the disclosure of sensitive database informati...

Themegoods DK authorization issue vulnerability

Themegoods DK 3.2.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from improper access control without authentication, which may allow attackers to modify data without proper authorization...