CVE Vulnerability Catalog

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and admin delete does not blacklist the JTI, leaving stolen tokens cryptographically valid until JWT secret rotation.

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS readers that render HTML-type summaries, affecting anonymous subscribers and other users.

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query, and fragment components. The redirect_uri is embedded into the signed state JWT at login time without validation. An attacker can craft a redirect_uri whose host matches an allowed origin but whose path is attacker-influenced; after the OAuth exchange the victim is redirected to that path with a one-time exchange code in the query string. If the code leaks (e.g., via Referer, analytics, or an open redirect on that host), the attacker can trade it at the public POST /api/auth/exchange endpoint for the victim's access and refresh tokens. Fixed in 4.7.3.

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav_count counter of any echo (including private echoes) by supplying its UUID, which can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation, allowing attackers to inflate popularity metrics and amplify load on the database and cache. Fixed in 4.7.3.

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.

Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text caps '-' characters but not '_' characters, which the parser aliases to '-', allowing quadratic-time parsing to be triggered with a large header (up to Go's default 1 MiB) built from underscore separators. An unauthenticated attacker can send such requests to consume roughly 1.5 seconds of CPU each, and concurrent requests can saturate a multi-core server (denial of service).

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer._execute and numpy.f2py.crackfortran.myeval through pickle REDUCE to execute arbitrary commands during model or tokenizer artifact loading.

A vulnerability was found in liketrek TREK up to version 3.0.22. The function journeyService.updateEntry in server/src/nest/journey/journey.controller.t is vulnerable to SQL injection. The attack can be performed remotely. Upgrading to version 3.1.0 fixes the issue.

vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests.

YOOtheme Pro for Joomla versions 1.0.0-5.0.41 has a missing access check, allowing users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions. This is an information disclosure for authenticated, privileged users.

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.

The Media Sweep – WordPress Media Cleaner plugin up to version 1.1.3 is vulnerable to generic SQL Injection via the 'fields' parameter. Insufficient escaping and lack of preparation on the SQL query allow authenticated attackers with administrator-level access to append additional SQL queries, potentially extracting sensitive information from the database.

The ShopEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.9.4. The `rum_importer()` function is registered on the `import_start` hook without proper capability checks, allowing authenticated attackers with Shop Manager-level access to write arbitrary WordPress options, including setting `users_can_register` to 1 and `default_role` to administrator, enabling open self-registration of Administrator accounts and full site takeover.

The Newsletters plugin for WordPress up to version 4.17 is vulnerable to authorization bypass. Authenticated attackers with author-level access and above can send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. The attacker can supply a role slug via the newsletters_mailinglistsroles POST field, enabling unauthorized mass-mailing and potential phishing.

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system.

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL injection in the archive restore functionality in all versions up to and including 7.109 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database, including the `ai1wm_secret_key`, and achieving remote code execution.

The Ultimate Member plugin for WordPress up to version 2.12.1 is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute). Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.