CVE Vulnerability Catalog

Wheels versions 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing.

The Flying Scripts plugin for WordPress (versions up to and including 1.2.4) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload uses only kses-allowed elements, and the XSS is introduced post-save by the plugin's output-buffer rewriter.

The RSS Aggregator by Feedzy plugin for WordPress (versions up to and including 5.2.11) is vulnerable to stored cross-site scripting via the 'media:thumbnail@url' parameter due to insufficient input sanitization and output escaping. The attacker must control an external RSS feed that the target site has already configured for import.

The Colibri Page Builder plugin for WordPress (versions up to and including 1.0.390) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload survives storage because the widened comment allow-list permits SVG elements, and execution occurs when colibri.js reads the stored data-target value and passes it to jQuery().

The Customer Email Verification for WooCommerce plugin (versions up to and including 3.3.0) is vulnerable to privilege escalation via the 'alg_wc_ev_verify_email' parameter. The activation code is generated using wp_rand(100), yielding only ~101 possible values, and the verify() handler lacks nonce checks and rate limiting.

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints due to missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to extract sensitive information from the database.

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height, causing writes past the U/V planes.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2. A local attacker can corrupt heap memory via integer wraparound in bitmap size calculation by supplying a crafted v2 persistent cache file with oversized width and height values.

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m). The audio queue buffer size is computed as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU, causing the multiplication to wrap and undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3. A local attacker can corrupt memory by supplying a crafted v3 persistent cache file with large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer.

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu. An unauthenticated attacker can exhaust server memory by completing TLS and streaming bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

A hard-coded cryptographic key vulnerability exists in /usr/bin/sysman of some Moxa industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market. It could allow a local authenticated user to execute arbitrary code with elevated privileges.

A flaw was found in WildFly. A user with the Monitor role, the lowest standard RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an arbitrary location, allowing the Monitor role to read back the server configuration, including sensitive credentials, leading to information disclosure.

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market. An attacker on the same logical network could exploit it to execute arbitrary code.

A vulnerability was found in bitcoinj up to 0.17 in the url.openConnection function of PaymentSession.java within the Payment Request Handler component. Manipulating the pki_type argument can lead to server-side request forgery, exploitable remotely, and the exploit has been publicly disclosed.

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson IDs to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user IDs. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.