CVE Vulnerability Catalog

Kiota before versions 1.29.1 and 1.32.0 in the Python generator did not sanitize enum value descriptions, allowing Python code injection into generated comments that could be executed when modules are imported.

Kiota before versions 1.29.1 and 1.32.0 in the Ruby generator did not escape the # character in string literals, allowing arbitrary Ruby code injection into generated model classes.

Kiota before versions 1.29.1 and 1.32.3 has a code-generation injection vulnerability in the C# XML documentation-comment sink, where text from an OpenAPI description is written without stripping newline characters, allowing injection of additional code into generated C# clients.

Kiota, an OpenAPI based HTTP client code generator, prior to versions 1.29.1 and 1.32.4 contains a PHP code injection vulnerability. The PHP generator fails to escape the $ character in double-quoted strings, allowing attacker-controlled interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes.

A race condition in the account lockout mechanism of Delphix Continuous Data allowed concurrent authentication requests to be processed before the failed-login counter and lockout status were updated, bypassing the lockout threshold.

A flaw was found in PipeWire, a multimedia server, allowing an attacker to escape sandboxed applications like Flatpak. The vulnerability exploits PipeWire's PulseAudio compatibility layer to load a malicious library from within a sandbox with minimal permissions.

Stoatchat before version 0.13.5 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains.

AVideo through version 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint. The notifyCode and callback parameters are concatenated into a shell command without escaping, allowing attackers to execute arbitrary OS commands as the web-server user.

In AVideo up to version 29.0, the listFFmpegProcesses() function in plugin/API/standAlone/functions.php interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

A vulnerability in stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allows users with ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, due to checking ViewChannel instead of ManageWebhooks in the webhook fetch endpoint.

In stoatchat (delta) versions before 20250210-1 (0.8.2), a logic error exists in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource exhaustion.

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to and including 2.7.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

A local privilege escalation vulnerability in ESET Inspect Connector. The issue is caused by improper authentication in an IPC channel.

The Joomla extension Quix Page Builder Pro versions below 6.2.1 is vulnerable to unauthenticated SQL injection. An attacker can send crafted queries without authentication.

The WPFunnels plugin for WordPress up to version 3.12.8 is vulnerable to privilege escalation via arbitrary option update. Lack of validation of the `group_id` parameter in the REST API allows attackers with `wpf_manage_funnels` capability to modify the `wp_user_roles` option, enabling them to assign themselves the administrator role.

The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.8.5. Missing nonce validation in the execTemplate function allows unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, bypassing path validation and leading to code execution.

The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function, allowing authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, provided the site administrator has configured the built-in DIGITS User Role field.