CVE Vulnerability Catalog

The Element Pack Elementor Addons plugin in versions up to and including 8.8.3 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.

The JetTabs plugin in versions up to and including 2.3.3.1 contains a Cross Site Scripting (XSS) vulnerability. A user with Contributor privileges can inject malicious script code.

The JetBlog plugin in versions up to and including 2.4.10 is vulnerable to Cross Site Scripting (XSS). A user with Contributor privileges can inject a malicious script.

The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.

Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. The description does not provide technical details of the exploitation mechanism.

Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. The description does not provide technical details of the exploitation mechanism.

Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. The description does not provide technical details of the exploitation mechanism.

The password reset functionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

In the MISP sachertortephp library, the Xml::build() static method contains a logic error in the condition controlling network-based XML fetching. Due to operator precedence, the HTTPS branch is executed even when the readFile option is set to false, allowing an attacker to force outbound HTTPS requests to arbitrary URLs (SSRF).

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.

The admin3 application through version 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.

The admin3 application through version 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

CVE was rejected by Red Hat Product Security, so it poses no threat.

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed.

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string) because GravExtension::assertSandboxDumpSafe() checks sandbox state without a Source argument, so the guard never executes. An authenticated user with page-edit rights can render {{ config|print_r }} and dump Grav's entire merged configuration, exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords.

In Grav (a flat-file CMS) versions 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint at /__clockwork/ is exposed without authentication. Because the shipped default is censored: false, stored records contain raw session cookies, plaintext login credentials, and the full system and plugin configuration including operator secrets. The issue is fixed in 1.7.53.4 and 2.0.22.

WWBN AVideo through commit e01e41ecc contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement, takes users_id directly from the query string and calls User::sendVerificationLink() with no session, CSRF token, relationship check or rate limit, allowing an unauthenticated attacker to send unlimited verification emails, enumerate accounts and write password-recovery tokens onto victim accounts.