CVE Vulnerability Catalog

Stored XSS vulnerability in the Xpro Addons plugin for WordPress (versions up to 1.4.24). Insufficient input sanitization and output escaping in the Icon Box widget allow authenticated attackers (contributor level and above) to inject malicious JavaScript.

The Gutenverse plugin for WordPress up to version 3.4.6 contains a stored XSS vulnerability via the 'imageLoad' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts.

The Pie Register plugin for WordPress has a missing capability check in the pie_main() function, allowing unauthenticated attackers to change registration form status. Affects versions up to and including 3.8.4.8.

Vulnerability in Electron (versions before 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8) on macOS. The app.moveToApplicationsFolder() function uses AppleScript that improperly handles certain characters in the path, potentially leading to arbitrary AppleScript execution when the user accepts the prompt.

In Electron prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, a service worker running in a session can spoof reply messages on the internal IPC channel used by webContents.executeJavaScript() and related methods, causing the main-process promise to resolve with attacker-controlled data.

In Electron prior to versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0, when an iframe requests fullscreen, pointerLock, keyboardLock, openExternal, or media permissions, the origin passed to session.setPermissionRequestHandler() was the top-level page's origin rather than the requesting iframe's origin. Apps that grant permissions based on the origin parameter may inadvertently grant permissions to embedded third-party content.

Electron before versions 38.8.6, 39.8.1, 40.8.1, and 41.0.0 on macOS and Linux has an out-of-bounds heap read vulnerability when parsing a crafted second-instance message if the app calls app.requestSingleInstanceLock(). Leaked memory can be delivered to the app's second-instance event handler. This issue is limited to processes running as the same user as the Electron app. Windows is not affected.

In Electron prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker setting was not correctly scoped. In certain process-sharing scenarios, workers spawned in frames with nodeIntegrationInWorker: false could still receive Node.js integration. Only apps that enable nodeIntegrationInWorker are affected.

Electron on Windows does not validate the protocol name in app.setAsDefaultProtocolClient() before writing to the registry. Apps passing untrusted input as the protocol name may allow an attacker to write to arbitrary registry subkeys, potentially hijacking existing protocol handlers.

Electron, a framework for building desktop applications, has a use-after-free vulnerability when apps allow downloads and programmatically destroy sessions. If a session is torn down while a native save-file dialog is open, dismissing the dialog dereferences freed memory, potentially leading to a crash or memory corruption. This affects versions prior to 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8.

Electron, a framework for building desktop applications, has an HTTP response header injection vulnerability. Apps that register custom protocol handlers via protocol.handle() or modify response headers via webRequest.onHeadersReceived may be vulnerable if attacker-controlled input is reflected into a response header name or value. This affects versions prior to 38.8.6, 39.8.3, 40.8.3, and 41.0.3.

In the Nimiq Proof-of-Stake Rust implementation (core-rs-albatross), two consensus request handlers assume the history index is always available, causing a panic (unwrap) during node sync. A remote attacker can crash the node.

Vulnerability in PraisonAI before version 4.5.90, where MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression without validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage.

Avahi, a system for service discovery on a local network via mDNS/DNS-SD, prior to version 0.9-rc4 is vulnerable to a DoS attack. Any unprivileged local user can send a single D-Bus method call with conflicting publish flags, causing avahi-daemon to crash.

A SQL injection vulnerability was found in Emlog version 2.6.2 and earlier in the updateTagName() function in include/model/tag_model.php. The function directly interpolates user input into SQL queries without parameterized queries, allowing SQL injection attacks.

In Emlog version 2.6.2 and earlier, a Local File Inclusion (LFI) vulnerability exists in admin/plugin.php. The $plugin parameter from the GET request is directly used in a require_once path without proper sanitization. If the CSRF token check can be bypassed, an attacker can include arbitrary PHP files from the server filesystem, leading to code execution.

Emlog prior to version 2.6.8 has a stored XSS vulnerability in the comment module via URI scheme validation bypass. Attackers can inject malicious scripts that execute when the comment page is viewed.

Emlog prior to version 2.6.8 contains a vulnerability in the backend upgrade interface that accepts remote SQL and ZIP URLs via GET parameters. The server downloads and executes the SQL file, then downloads the ZIP file and extracts it directly into the web root. The process does not validate a CSRF token, so an attacker can trick an authenticated administrator into visiting a malicious link, leading to arbitrary SQL execution and file write.

nimiq/core-rs-albatross prior to version 1.3.0 contains a vulnerability where an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept the proposal because verify_macro_block_proposal() does not check the interlink binding for election blocks. The same finalized block is later rejected by verify_block() with InvalidInterlink, but this happens after Tendermint decides, potentially causing consensus issues.

In LTI JupyterHub Authenticator prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service.