CVE Vulnerability Catalog

Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() check rather than a scope-aware permission check, so a least-privilege API key (scoped to api.users.write) minted on a super account can create an invitation record containing super-admin access flags. When the invitation is accepted, those flags are written verbatim to the new account, resulting in privilege escalation to a fully controlled super account.

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or from fields to achieve remote code execution when forms are submitted.

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission() requires only the baseline api.access scope, and the new key's scopes are read directly from the request body with no subset check. An attacker holding a minimal-scope API key on a super account can submit an empty scopes array to mint an unscoped, full-access super key, bypassing scope restrictions (and enabling further chains such as configuration write to RCE).

The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of requireSuper(). Because isSuperAdmin() reads access.api.super directly and never consults api_key_scopes, a least-privilege API key scoped to api.config.write minted on a super account passes the gate, allowing an attacker to append attacker-chosen tokens to the security.twig_sandbox allowlist (persisted to user/config/security.yaml). Widening the allowlist turns any subsequent Twig-in-content render into an SSTI/RCE sink.

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does not consult api_key_scopes, so a least-privilege API key scoped only to api.pages.write and minted on a super account can enable process.twig on a page save even though admin.pages_twig is intentionally outside the api.pages scope. When security.twig_content.process_enabled=true and editor_enabled=false, this allows Twig-in-content to execute server-side, resulting in server-side template injection (SSTI) and remote code execution.

The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin (non-self) path solely via ACL reads (isSuperAdmin/hasPermission) and never invokes requirePermission(), so the api_key_scopes cap is never applied. As a result, a holder of a narrow-scope API key on a super account, or a non-super account whose ACL includes api.users.write, can force-disable two-factor authentication on any non-super target account via POST /api/v1/users/{user}/2fa/disable without providing a TOTP code, facilitating account takeover.

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation. An authenticated user can upload a ZIP file containing PHP code, bypass name validation using array notation, and write PHP files to the web root for execution.

SiYuan before v3.7.4 contains a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.

A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The function lstAdd of the file /goform/editQos in the QoS Edit component is affected. Manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely, and the exploit is publicly available.

A buffer overflow vulnerability was found in the Tenda AC12 router version 15.03.06.23_multi_TD01 in the formSetRebootTimer function in the file /goform/SetSysAutoRebbotCfg of the httpd web management interface. Manipulating the rebootTime argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setParentalRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the urlKeyword argument can lead to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been published.

A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setMacQos function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the macAddress argument can lead to a stack-based buffer overflow. The attack can be initiated remotely, and the exploit is now public.

A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setMacFilterRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the Comment argument can lead to a stack-based buffer overflow. The attack can be performed remotely, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the UploadCustomModule function in the file /cgi-bin/cstecgi.cgi of the product.so component. Manipulating the File argument can lead to a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been made public.

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 2.56 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page.

A stack-based buffer overflow vulnerability was found in the TOTOLINK A800R router version 4.1.2cu.5137_B20200730 in the setIpQosRules function in the file /cgi-bin/cstecgi.cgi of the firewall.so component. Manipulating the Comment argument can lead to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been released to the public.

The Essential Addons for Elementor WordPress plugin before version 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.

The Paymob for WooCommerce plugin before version 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.

A security flaw has been discovered in Tenda G0 up to 20260625. The function setPortMapping in /goform/module of the httpd web management interface is affected. Manipulating the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack can be carried out remotely, and the exploit is public.

A weakness has been identified in Tenda G0 up to 20260625. The function addStaticRoute in /goform/module of the httpd web management interface is affected. Manipulating the argument staticRouteNet leads to stack-based buffer overflow. The attack can be performed remotely, and the exploit is public.