CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability was found in Privoce Vocechat up to version 0.9.121, in the widget.html file's handling of the 'welcome' query parameter. Manipulation of this argument allows execution of malicious script. The attack can be launched remotely, and the exploit has been publicly disclosed.

A path traversal vulnerability was found in eventcatalog sdk up to version 2.29.0, affecting the getCustomDoc, writeCustomDoc, and rmCustomDoc functions in packages/sdk/src/custom-docs.ts. Manipulation of the options.path argument allows a local attacker to perform path traversal. The issue is fixed in version 2.30.0.

A path traversal vulnerability was detected in 1999AZZAR designer-mcp up to version 2.1.0, affecting the get_reference function in skills/motion-designer/references/motion-dev-guidelines.md within the MCP Interface. Manipulation of the Name argument allows remote exploitation, and the exploit is publicly available. The product uses rolling releases, so version details are unavailable; patch c8c2951dcbed9b1710a745993f028317f10a3f10 is identified.

The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification originated from the payment provider before marking the associated order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without any payment being made.

A vulnerability was detected in prasathmani TinyFileManager up to 2.6 in the remote URL file upload module of tinyfilemanager.php. The manipulation leads to unrestricted upload, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard. This allows users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.

The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to. This allows users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute. This allows users with a custom form-editing role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk. This allows users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the plugin's stored configuration.

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route. This allows unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state. This allows unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

A SQL injection vulnerability was found in pig-mesh pig up to version 4.1.0, affecting the orderItem.getColumn function in SqlFilterArgumentResolver.java. Manipulating the ascs/descs arguments allows SQL injection, and the attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in phpIPAM up to 1.8.3 in the create_rack_link function of app/tools/racks/show-rack-popup.php (Rack Link Creation component). Manipulation of the deviceid argument results in cross site scripting. The issue can be exploited remotely and a public exploit is already available.

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 affecting the UnAuthController.changeStatus/close/open/resolve functions in app/Http/Controllers/Client/helpdesk/UnAuthController.php. Manipulating the id/status arguments leads to missing authorization, and the attack can be launched remotely.

A vulnerability was found in Travisun Opptrix 0.4.0 affecting the Buffer.concat function of the /api/channels/webhook/ file in the preParsing handler component. Manipulation results in denial of service, and the attack can be initiated remotely. The exploit has been made public and could be used.

The WpEvently plugin (versions up to 5.7.8) by Magepeople inc. contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.