CVE Vulnerability Catalog

The WPJAM Basic plugin version 7.0 and earlier contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can exploit this flaw to execute arbitrary code or perform other unauthorized actions.

The Themify Builder plugin for WordPress contains a reflected XSS (Cross-site Scripting) vulnerability due to improper input neutralization during page generation. The issue affects versions up to and including 7.7.4.

The Jobmonster plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This issue affects all versions up to and including 4.8.5.

The ChatBot plugin for WordPress up to version 8.3.7 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject a malicious script that executes on every page load.

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. Manipulating the data value allows arbitrary OS commands to be executed as root.

The charging station does not require authentication for Bluetooth commands, allowing unauthorized devices to perform actions. The vulnerability enables sensitive information leakage, triggering reboots, or pushing a firmware update URL.

A weakness has been identified in waooAI waoowaoo up to version 0.4.1, where improper authentication occurs in the functions getInternalTaskSession, getAuthSession, requireUserAuth, requireProjectAuth, and requireProjectAuthLight in src/lib/api-auth.ts. Manipulation of the x-internal-user-id request argument allows remote authentication bypass. The exploit is publicly available and could be used for attacks.

A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.

A Server-Side Request Forgery (SSRF) protection bypass was found in the html_to_markdown expansion module of misp-modules. IPv4-mapped IPv6 addresses were not normalized before blocked-range checks, allowing attacks on loopback, internal, or link-local networks.

A flaw in the vllm-orchestrator-gateway component causes all incoming authorization headers and full chat payloads to be logged persistently, exposing bearer tokens and sensitive conversation content to any user with log access.

In Shibby Tomato up to version 1.28.0000, a vulnerability was found in the main function of the file www/apcupsd/tomatodata.cgi of the apcupsd component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is publicly available.

In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.

A vulnerability was found in the Isaiah library up to version 1.36.9 in the WebSocket connection authentication component. An unknown function in app/main.go allows improper authentication, exploitable remotely. A fix is pending in a pull request.

A missing authorization vulnerability was found in will-moss Isaiah up to version 1.36.9 in the Server.Handle function of app/server/server/server.go within the Master Websocket Handler component. Manipulation of the Agent argument allows remote exploitation without proper authorization.

The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.

A SQL injection vulnerability has been discovered in SourceCodester Online Book Store System 1.0 in the file admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been publicly released.

The Library Management System WordPress plugin before version 3.5.8 does not sanitize or escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.

The Tutor LMS WordPress plugin before version 3.9.13 fails to enforce enrollment, purchase, and private-course capability checks in its Droip and Kirki page-builder integration. This allows authenticated users with subscriber-level access to enroll in paid or private courses, read private course content, and mark arbitrary courses as completed.

The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.