CVE Vulnerability Catalog

Stored XSS vulnerability in the Draft Notify plugin (up to version 1.5) allows persistent injection of malicious script, which will be executed in users' browsers.

CSRF vulnerability in Trade Runner up to version 3.14. Allows an attacker to perform unauthorized actions in the context of a logged-in user.

Server-Side Request Forgery (SSRF) vulnerability in 6Storage Rentals (up to 2.22.0) allows an attacker to send requests from the server to internal resources.

The Eight Day Week Print Workflow plugin for WordPress contains a sensitive system information exposure vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 1.2.5.

A vulnerability was found in the Linux kernel's BPF test infrastructure that allowed generating invalid GSO (Generic Segmentation Offload) packets and sending them to the network stack. The issue occurred when a BPF program used bpf_clone_redirect() to redirect a packet to the loopback interface, triggering a skb_warn_bad_offload() warning and disabling GSO features.

A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to inject malicious JavaScript or HTML into the Name field, leading to script execution in victims' browsers.

A stored cross-site scripting (XSS) vulnerability exists in the Page Settings module of Piranha CMS v12.1. Attackers can inject malicious JavaScript or HTML into the Excerpt field, leading to script execution in victims' browsers.

The Amazon affiliate lite Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0. Missing nonce validation on the 'ADAL_settings_page' function allows unauthenticated attackers to update plugin settings via a forged request, if they can trick an administrator into clicking a link.

The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rsSlider shortcode in all versions up to and including 1.0.2 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject scripts that execute when a user accesses an injected page.

The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check in the 'file_download' function in versions up to and including 1.4.4. Unauthenticated attackers can download any file from the WordPress media library by guessing or enumerating attachment IDs.

The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings.

A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.

A flaw in code-projects Simple Stock System 1.0 affects an unknown function in the file /market/chatuser.php, leading to cross site scripting (XSS). The attack can be carried out remotely. The exploit has been published and may be used.

CSRF vulnerability in Turms Admin API up to v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

Turms Server version 0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects, and after successful login, raw passwords are stored unencrypted in memory in the rawPassword field.

Turms AI-Serving module v0.10.0-SNAPSHOT and earlier contains an improper file type validation vulnerability in the OCR image upload functionality. The OcrController in turms-ai-serving/src/main/java/im/turms/ai/domain/ocr/controller/OcrController.java uses the @FormData(contentType = MediaTypeConst.IMAGE) annotation to restrict uploads to image files, but this constraint is not properly enforced. The system relies solely on client-provided Content-Type headers and file extensions without validating actual file content using magic bytes (file signatures). An attacker can upload arbitrary file types including executables, scripts, HTML, or web shells by setting the Content-Type header to "image/*" or using an image file extension. This bypass enables potential server-side code execution, stored XSS, or information disclosure depending on how uploaded files are processed and served.

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted URI. This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the SSH process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

Podatność typu 'Open Redirect' w systemie dostarczania jedzenia online firmy Restajet Information Technologies Inc. umożliwia przekierowanie użytkowników na niezaufane strony, co może prowadzić do phishingu oraz nieautoryzowanego przeglądania.

A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Layer Import functionality. A crafted payload injected into the “Create new Layer” field during layer import is rendered into the DOM without proper sanitization, causing the injected script to execute when the Layers panel is accessed.