CVE Vulnerability Catalog

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This allows unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data.

OpenSupports udostępnia punkt końcowy, który pozwala na edytowanie listy 'nadzorowanych użytkowników' dla dowolnego konta, nie weryfikując, czy aktor jest właścicielem tej listy. Pracownik na poziomie 1 może zmodyfikować relację nadzoru innej osoby, co pozwala jej na przeglądanie zgłoszeń dodanych 'nadzorowanych' użytkowników.

nopCommerce 4.40.3 is vulnerable to XSS in the Product Name field at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires.

Podatność związana z użyciem twardo zakodowanych poświadczeń w oprogramowaniu TigerWings ERP firmy Logo Software Inc. umożliwia odczyt wrażliwych stałych w obrębie pliku wykonywalnego. Problem dotyczy wersji TigerWings ERP od 01.01.00 do przed 3.03.00.

The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.8.2. This is due to missing or incorrect nonce validation on the advParallaxBackAdminSaveSlider function, allowing unauthenticated attackers to create or modify background sliders via a forged request if they can trick a site administrator into clicking a link.

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to missing or incorrect nonce validation on the update() function, allowing unauthenticated attackers to update plugin settings via a forged request if they can trick an administrator into performing an action.

The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due to missing nonce validation on form creation and management functions, allowing unauthenticated attackers to create new PayPal forms and modify PayPal payment settings via a forged request if they can trick an administrator into performing an action.

Podatność CVE-2025-0876 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie IT's Workif, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji systemu do 20251003.

A Server-Side Request Forgery (SSRF) vulnerability in VitaraCharts 5.3.5 in fileLoader.jsp allows an attacker to send requests from the server to internal network resources.

AndSoft e-TMS version v25.03 contains a reflected XSS vulnerability. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerability affects the 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_DELCROIX.ASP'.

FortiOS and FortiProxy have an authentication bypass vulnerability that may allow an authenticated attacker to elevate their privileges by triggering a malicious Webhook action in the Automation Stitch component.

W podatności CVE-2025-0642 występuje wykorzystanie twardo zakodowanych poświadczeń oraz możliwość obejścia autoryzacji za pomocą klucza kontrolowanego przez użytkownika w oprogramowaniu PosCube. Problem ten umożliwia przeprowadzenie wykopów oraz obejście procesu uwierzytelniania.

Ekushey CRM v5.0 by Creativeitem has a stored XSS vulnerability due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.

A vulnerability in Viday exposes sensitive information by allowing an attacker to intercept HTTP requests and extract JWT tokens containing user data in the payload.

In the Linux kernel, in the NTFS3 filesystem (fs/ntfs3), there is a memory leak on the error path in ntfs_fill_super(). The fix frees mount options on error, eliminating the leak.

In the Linux kernel, in the hisilicon/hpre cryptographic driver, the hpre_remove() function may return directly after a failed sriov disable operation, leading to resource leak. The fix continues to release remaining resources even after an error.

In the Linux kernel, the CAN J1939 protocol lacked a NETDEV_UNREGISTER notification handler, causing issues with network interface unregistration (e.g., vcan0). This led to hangs in unregister_netdevice due to unreleased references.

The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to and including 1.1.12 via the mcbSubmit_Form_Data() function. Unauthenticated attackers can make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.

An out-of-bounds read vulnerability in the OpenSSL HTTP client occurs when the 'no_proxy' environment variable is set and the host in the URL is an IPv6 address. This can cause a crash leading to Denial of Service (DoS).