CVE Vulnerability Catalog

The WSP MCP – AI Agents Connector plugin in versions up to 2.7.0 contains a Broken Access Control vulnerability that allows a user with the Contributor role to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for higher roles.

Contributor SQL Injection in Live Copy Paste for Elementor versions up to 1.5.10.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.

The SiteSkite plugin in versions up to 2.1.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows a user with the Contributor role to access objects they should not have permission to. The lack of proper permission verification on object references enables manipulation of identifiers to gain unauthorized access.

Mesop is a Python-based UI framework for building web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.

Joomla Easy Store extension (versions 1.0.0-3.0.0) lacks CSRF and access control on site configuration update, allowing modification of Joomla mail settings without token verification or admin permissions.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a broken access control vulnerability (ACL bypass) in the allowEdit() method in ApiController.php. This method always returns true, bypassing component-level and asset-level ACL permission checks. Any authenticated backend user can edit any EasyStore record regardless of specific ACL grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) lacks CSRF token verification on most administrator AJAX endpoints. Tokens are only checked in the products() action, while other endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections) accept state-changing requests without anti-CSRF tokens. An attacker can trick a logged-in administrator into triggering unauthorized modifications. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in the coupon bulk update task (couponBulkUpdate). Input IDs are directly concatenated into raw SQL IN (...) clauses without sanitization or parameterization. An authenticated administrator can manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers and using parameterized ->whereIn() queries.

Authenticated, privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0. The media deletion endpoint parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses without integer casting or parameterization.

The Joomla Easy Store extension (joomshaper.com) in versions 1.0.0-3.0.0 contains a Missing CSRF Token Verification vulnerability in the product review submission endpoint (index.php?option=com_easystore&task=product.addReview). The endpoint accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has an unauthenticated PII exposure vulnerability via IDOR in guest checkout. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.

A flaw in Red Hat Ansible Automation Platform's automation-controller: the Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=<command>:x" is interpreted by git as the --upload-pack option and executed via a shell. A user with permission to create or modify a project in a single organization can thereby execute arbitrary commands on the control-plane task pod, with output reflected through the project update stdout endpoint, leading to cross-tenant compromise and in-cluster lateral movement.

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.

In Red Hat Ansible Automation Platform's automation-controller, four debug views that trigger the internal task, dependency, and workflow schedulers are accessible to any user, including unauthenticated clients, because their URL routing is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock, causing real scheduler runs to be skipped and stalling job dispatch for all tenants while consuming controller web workers.

A flaw in Red Hat Ansible Automation Platform's automation-controller: the provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when the controller is deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template's inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using the job template's credentials, resulting in privilege escalation and remote code execution on managed hosts.