CVE Vulnerability Catalog

An authorization bypass vulnerability in PAVO Pay allows exploitation of trusted identifiers via a user-controlled key. The issue affects versions up to 09072026. The vendor did not respond to the disclosure.

The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.

A permissive CORS policy in the REST API (helix-rest) of Apache Helix through version 2.0.0 allows a remote attacker controlling a web page visited by an authorized user to read responses and issue cross-origin requests to administrative endpoints. The CORSFilter unconditionally returns Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true and reflects arbitrary request headers.

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

A vulnerability in the Remote Collector allows man-in-the-middle attacks because the configuration generated by n2os-tui disables TLS certificate verification for connections to the Guardian or CMC, with no option to enable it.

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.

The Connect Contact Form 7 and Mailchimp plugin for WordPress up to version 0.9.78.06 is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator accesses the injected page via Contact Lookup.

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes.

The GenerateRandomPassword function in bosh-windows-stemcell-builder uses a cryptographically weak random number generator, allowing a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions are prior to v2019.98.

A vulnerability in the BOSH.Utils.psm1 script of bosh-windows-stemcell-builder allows low-privileged authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe. Upon service or system restart, an attacker can gain NT AUTHORITY\SYSTEM privileges, leading to full host control.

An argument injection vulnerability in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned SSH process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation.

A vulnerability in BOSH CLI (versions prior to 7.10.4) causes the client to skip server certificate verification for DAV blobstore during create-env and delete-env operations, allowing a network attacker to intercept Basic-auth credentials and read the rendered-templates archive containing all bootstrap secrets for the new BOSH Director.

The Everest Forms WordPress plugin before version 3.5.0 does not reliably delete temporary CSV files generated during email notification processing, leaving them publicly accessible in the uploads directory. This allows unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.

The Divi Form Builder plugin for WordPress up to version 5.1.8 has an authorization bypass vulnerability. The update_user() function accepts a user ID from form submissions without verifying permissions, and handle_register_submission() only checks if a user is logged in, not if they can edit the target account. This allows authenticated attackers with subscriber-level access or higher to change the email and password of any user, including administrators, leading to full account takeover.

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI prior to 7.10.5.

A SQL injection vulnerability has been found in Interview Management System 1.0 in the file \inc\classes\View.php via the ID argument. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability has been discovered in code-projects Online Food Order System 1.0 in the /edit_food_items.php file. Remote manipulation of the update argument allows SQL injection. The exploit has been publicly released.

A SQL injection vulnerability was found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/index.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit has been publicly disclosed.

A vulnerability in Cline Hub dashboard server before version 3.0.30 allows an attacker to send desktopCommand frames via WebSocket without Origin header validation. When ROOM_SECRET is unset for local 127.0.0.1 binds, the isAuthorizedBrowserRequest() function enables attacker-controlled websites to read workspace state, mutate MCP and provider settings, and trigger command execution.