hwk-fr ACF Extended cross-site scripting vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...

Kavita path traversal vulnerability

Versions Kavita 0.5.2 through 0.5.4.1 contain a path traversal vulnerability. This vulnerability arises because the filename parameter allows path traversal; unauthenticated attackers can send GET requests containing ../ sequences to /api/image/cover-upload to read any file outside the temporary...

i-Netsolution Readymade Unilevel Ecommerce MLM SQL injection vulnerability

The i-netsolution Readymade Unilevel Ecommerce MLM version for 2024-03-15 contains an SQL injection vulnerability. This flaw stems from improper input validation of the id parameter in /product-details.php. Unauthorized attackers can exploit this by sending boolean, stack-based, or time-based SLE...

TMS Amelia SQL injection vulnerability

TMS Amelia versions 2.4.11 and earlier contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, making them susceptible to SQL injection attacks...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.1 of CNCF OpenTelemetry Python contain a resource management error vulnerability. This vulnerability stems from the TraceState.fromheader function in opentelemetry/trace/span.py within the opentelemetry-api. When parsing W3C trace state headers, it uses an...

WordPress User Profile Builder permission and access control issue vulnerability

WordPress User Profile Builder versions 4.0.4 and earlier contain a privilege escalation vulnerability related to permission handling and access control. This issue stems from improper permission allocation and may lead to privilege escalation...

GitLab trust management issue vulnerability

GitLab EE versions prior to 17.8 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain a trust management vulnerability. This vulnerability stems from insufficient server-side validation during billing eligibility checks, potentially allowing authenticated users to access paid AI...

Javo Spot path traversal vulnerability

Versions of Javo Spot prior to 3.0.0 contain a path traversal vulnerability. This vulnerability stems from a path traversal issue in the fn parameter of the jvfrmspotgetjson AJAX operation. Unauthenticated attackers can read arbitrary files, potentially obtaining database credentials and keys...

GitLab numeric error vulnerability

A numerical error vulnerability exists in GitLab CE/EE versions from 7.0 up to and including 18.11.13, in version 19.0 prior to 19.0.10, in version 19.1 prior to 19.1.9, in version 19.2 prior to 19.2.9, in version 19.3 prior to 19.3.6, in version 19.4 prior to 19.4.3, and in version 19.5 prior to...

PHPOffice PhpSpreadsheet resource management error vulnerability

Versions prior to PHPOffice PhpSpreadsheet 1.30.7, versions 2.0.0 through 2.1.19, versions 2.2.0 through 2.4.8, versions 3.3.0 through 3.10.8, and versions 4.0.0 through 5.10.0 contain a resource management error vulnerability. This vulnerability stems from Ods::processTableRow in...

MetInfo path traversal vulnerability

Versions prior to MetInfo 6.1.1, specifically version 6.0.0, contain a path traversal vulnerability. This vulnerability stems from a path traversal issue in the dir parameter within the file /include/thumb.php. Attackers can send specially crafted requests containing backslashes to bypass...

midgetspy Sickbeard cross-site scripting vulnerability

The midgetspy Sickbeard vulnerability stems from a cross-site scripting flaw. This arises due to improper handling of the “pattern” parameter in /config/postProcessing/testNaming; the testNaming handler fails to escape returned content. As a result, unauthenticated attackers can craft GET request...

WordPress ShopMagic information disclosure vulnerability

WordPress ShopMagic versions 4.9.1 and earlier contain an information disclosure vulnerability. This vulnerability arises from the insertion of sensitive information into externally accessible files or directories, potentially allowing attackers to retrieve the embedded data...

Improper Mattermost exception handling vulnerability

Mattermost versions 11.7.11 and earlier in the 11.7.x series contain an improper exception handling vulnerability. This vulnerability arises from the failure to validate empty elements when decoding playbook import conditions; it may allow authenticated attackers to trigger a crash within Playboo...

GitLab authorization issue vulnerability

GitLab CE/EE versions prior to 15.10 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks on user-supplied project filtering parameters within the group milestone API. As a result,...

Roundcube Webmail Project Roundcube Webmail permission and access control issues vulnerability

The Roundcube Webmail project contains a permission and access control vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from CSS scope bypass in HTML messages. The rcubeutils::modcssstyles function fails to treat the “at-rule” prefix as a selector...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcmailsendmail::extractinlineimages fails to validate the media type within inline image data URIs. Remote authenticated attacke...

Traefik Labs Traefik authorization issue vulnerability

Traefik Labs Traefik versions prior to 3.7.0 and 3.7.14 contain an authorization issue vulnerability. This vulnerability arises because the Kubernetes Ingress-NGINX provider forwards client-supplied Ssl-Client- headers to plaintext HTTP routers. When ssl-redirect is disabled and...

Traefik Labs Traefik authorization issue vulnerability

In Traefik Labs Traefik versions 3.7.13 through 3.7.14, there is an authorization issue vulnerability. This vulnerability stems from HTTP router generation in the Kubernetes Ingress NGINX provider for non-TLS ingress points; no access control annotations are applied to generated routes. As a...

LocalStack security vulnerability

A security vulnerability exists in LocalStack version 4.9.2. It arises when a URL hosting specially crafted content is passed as templateURL to the localstack/cloudformation/deploy endpoint, potentially allowing arbitrary code execution within a Docker container environment...

GitLab authorization issue vulnerability

Versions prior to GitLab EE 19.3.6—specifically 19.2, 19.4 prior to 19.4.3, and 19.5 prior to 19.5.1—are affected by an authorization issue vulnerability. This vulnerability stems from insufficient granularity in administrator lockout controls; it may allow authenticated users with group Owner...

Amazon AWS SAM CLI command injection vulnerability

Versions of Amazon AWS SAM CLI prior to 1.166.2 contain a command injection vulnerability. This vulnerability stems from OS command injection within Terraform hooks; attackers can influence the Terraform configuration or plan files used during builds. By using specially crafted Terraform resource...

GitLab information disclosure vulnerability

GitLab CE/EE versions prior to 15.0 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an information disclosure vulnerability. This vulnerability arises from an error in caching fragment keys that are unrelated to viewers; it results in user-anonymized rendered content being...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises from the addition of stacked statements to custom metric queries. Attackers can submit SQL statements separated by semicolons via POST /app/metrics/, bypassing only the first statement validation...

Lexi Wilson exposed a resource management error vulnerability

Lexi Wilson has identified a resource management error vulnerability in versions 0.1.0 and later of esaml. This vulnerability arises because when esamlbinding:decoderesponse/2 uses xmerlscan:string/2 to parse SAML Responses, it registers element names, attribute names, and namespace prefixes as...

WordPress SureDash authorization issue vulnerability

WordPress SureDash versions 1.12.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

Better-Auth authorization issue vulnerability

Versions 1.4.0-beta.18 through 1.7.7 of better-auth contain an authorization vulnerability. This vulnerability arises when Magic Link is enabled and storeToken is set to plain, or when storeToken is set to hashed while global verification.storeIdentifier is also set to hashed; additionally, if th...

Drupal Monobank payment API encryption issue vulnerability

The Drupal Monobank payment API versions prior to 0.0.0 and 1.0.3 contain an encryption-related vulnerability. This vulnerability stems from improper validation of encrypted signatures, potentially allowing signature forgery...

Drupal Webform authorization issue vulnerability

Drupal Webform versions prior to 0.0.0 and from 6.2.12 up to 6.3.0, as well as versions from 6.3.0 up to 6.3.1, contain an authorization issue vulnerability stemming from improper authorization checks, which may lead to forced browsing...

Drupal amazee.ai Private AI Provider SQL injection vulnerability

Drupal amazee.ai Private AI Provider versions prior to 0.0.0 and 1.3.7, as well as versions prior to 1.4.0 and 1.4.3, contain an SQL injection vulnerability. This vulnerability stems from improper handling of special elements within SQL commands, potentially leading to SQL injection attacks...

CrawlSEO encryption issue vulnerability

Versions of crawlseo prior to 0.2.5 contain an encryption vulnerability. This vulnerability arises because Google OAuth access tokens and refresh tokens are stored unencrypted in the User.googleTokens column. Attackers with database read permissions can read these plaintext long-lived refresh...

Drupal SAML SSO – Service Provider Authorization issue vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain an authorization issue vulnerability. This vulnerability stems from improper storage of sensitive information, potentially allowing retrieval of embedded sensitive data...

WordPress Page and Post Restriction authorization issue vulnerability

WordPress Page and Post Restriction versions 1.6.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control levels...

Drupal SAML SSO – Service Provider encryption issue vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain an encryption-related vulnerability stemming from improper certificate validation, which may lead to man-in-the-middle attacks...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because rcubewashtml fails to validate the by attribute in SVG SMIL animations; as a result, tags within HTML emails can load remote...

PHPOffice PhpSpreadsheet input validation error vulnerability

PHPOffice PhpSpreadsheet versions 1.30.7, 2.1.19, 2.4.8, 3.10.8, and earlier versions prior to 5.10.0 contain a security vulnerability. This vulnerability arises because the DOCTYPE detection mechanism in XmlScanner::scan fails to account for ISO-2022 escaped sequences within XLSX XML sections. A...

Discourse cross-site scripting vulnerability

Versions 1.9.0.beta2 through 1.9.0.beta13 of Discourse contain a cross-site scripting vulnerability. This arises from the lack of validation on the /email/unsubscribed email parameter; the unsubscribed.html.erb file uses htmlsafe without proper escaping. As a result, it may be exploited for...

Retool cross-site scripting vulnerability

Versions prior to Retool 3.88.0 contain a cross-site scripting vulnerability. This vulnerability arises when malicious SVG files are passed via the /api/imageProxy endpoint; the URL parameter allows attackers to upload such SVGs, which then execute JavaScript within the victim’s session,...

OpenCATS cross-site scripting vulnerability

Versions prior to OpenCATS 0.12.0 contain a cross-site scripting vulnerability stemming from a stored XSS issue: low-privilege authenticated users can inject HTML/JavaScript payloads by setting the name/title fields of Candidate, Company, Contact, Job Order, or List. These payloads are not...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises from using the subject line of forwarded emails verbatim to generate attachment names. When the subject contains a CRLF sequence, it may...

Roundcube Webmail Project Roundcube Webmail Input validation error vulnerability

The Roundcube Webmail project contains an input validation error vulnerability in versions prior to 1.6.20 and 1.7.5 within the 1.7.x series. This vulnerability arises because the flag parameter in the mail/mark action fails to filter CRLF sequences, potentially allowing remote authenticated...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises because the billable metric propertyname and category filter values are rendered directly into Jinja-generated queries for counting, dashboards, and rate metrics without proper escaping. As a resul...

Drupal Webform authorization issue vulnerability

Versions prior to Drupal Webform 6.2.12 and 6.3.1 contain an authorization issue vulnerability stemming from improper authorization checks, which may lead to server-side request forgery...

TOTOLINK a950rg firmware input validation error vulnerability

The TOTOLINK a950rg firmware version 4.1.2cu.5268B20221104 contains a security vulnerability. This vulnerability stems from improper handling of the FileMd5 parameter in the UploadCustomModule function within the file lib/cstemodules/product.so. It may lead to command injection, allowing attacker...

Drupal CSS Usage Analyzer authorization issue vulnerability

Drupal CSS Usage Analyzer versions 1.0.0 through 1.0.2 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks and may lead to forced browsing...

WordPress SureCart authorization issue vulnerability

WordPress SureCart versions 4.9.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from susceptibility to deception attacks, leading to authentication bypass and potential for unauthorized use of authentication mechanisms...

Drupal AI CKEditor code injection vulnerability

Drupal AI CKEditor versions prior to 0.0.0 and 1.4.3 contain a code injection vulnerability. This vulnerability stems from improper handling of special elements within the template engine, potentially leading to code injection...

Drupal Key auth information disclosure vulnerability

Drupal Key auth versions 0.0.0 through 2.2.4 contain an information disclosure vulnerability. This vulnerability stems from using a web browser cache that contains sensitive information, potentially allowing attackers to exploit improperly configured access control security levels...

Drupal Email Verification / SMS Verification / OTP Verification authorization issue vulnerability

Drupal Email Verification / SMS Verification / OTP Verification versions prior to 2.4.0 contain an authorization issue vulnerability. This vulnerability arises from the use of alternative paths or channels, potentially leading to authentication bypass...

Drupal Islandora authorization issue vulnerability

Drupal Islandora versions 0.0.0 through 2.19.0 contain an authorization issue vulnerability stemming from missing authorization checks, which may lead to forced browsing...