CVE Vulnerability Catalog

The SKT Page Builder plugin by sonalsinha21 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.9.

The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 6.4.8 due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This allows unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.

The Fancy Product Designer plugin for WordPress in all versions up to and including 6.4.8 is vulnerable to Information Disclosure and PHAR Deserialization due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This allows unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.

The JetFormBuilder plugin for WordPress up to version 3.5.3 lacks a capability check on the run_callback function, allowing unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

HCL DevOps Deploy is susceptible to cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. An attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the bulk_action_generate_handler function in all versions up to and including 4.2.1. This allows authenticated attackers with Contributor-level access and above to delete or generate featured images on posts they do not own.

The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to and including 4.1.3. Unauthenticated attackers can enumerate users and retrieve their email addresses and other information such as usernames, display names, user roles, and registration dates by providing a user ID.

The CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specific communication state, the product's resources may be consumed abnormally.

CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web page while logged into the product, unintended operations may be performed on the product.

A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts.

A vulnerability was identified in Ningyuanda TC155 version 57.0.2.0 affecting an unknown function of the file /onvif/device_service of the ONVIF PTZ Control Interface component. The manipulation leads to improper access controls. The attack requires being on the local network, and the exploit is publicly available.

A vulnerability in Ningyuanda TC155 57.0.2.0 affects an unknown function in the file /onvif/device_service of the ONVIF Device Management Service. Manipulating the FactoryDefault argument with the value Hard leads to improper access controls. The attack requires local network access, and the exploit has been publicly disclosed.

A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the RTSP Service component. Manipulation results in denial of service. The attack must originate from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Ningyuanda TC155 version 57.0.2.0 affecting an unknown function of the RTSP Live Video Stream Endpoint component. The manipulation leads to improper authentication. The attack must be carried out from within the local network, and the exploit has been publicly disclosed.

Parse Server before versions 8.6.1 and 9.1.0-alpha.3 has a Reflected Cross-Site Scripting (XSS) vulnerability in password reset and email verification HTML pages. The patch in versions 8.6.1 and 9.1.0-alpha.3 escapes user-controlled values.

ALTCHA libraries contain a cryptographic semantic binding flaw that allows challenge payload splicing, potentially enabling replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime. The issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation.

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise.

Weblate, a web based localization tool, in versions prior to 5.15 allowed retrieving user notification settings or listing all users via API. Version 5.15 fixes the issue.

Weblate is a web-based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue.