CVE Vulnerability Catalog

A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.

A heap buffer overflow vulnerability in LibreOffice Calc occurs when compiling a very long formula with many opening tokens. The nesting depth tracking array is too small, causing a write past its end.

A heap use-after-free occurs when importing blank-width characters of an ODF number format. The position read from the document was not checked against the format string length, allowing out-of-bounds memory access.

In Mastodon, versions with a missing condition in the check for remote accounts' consent to be featured in a remote Collection allow attackers to bypass this check and fake consent. This can lead to a situation where an account appears to be allowed in a Collection when it actually is not.

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

The Pizzy Library from MIA Technology Inc. has a vulnerability related to improper neutralization of formula elements in a CSV file, allowing for code injection.

The vulnerability in MIA Technology Inc.'s Pizzy Library related to improper control of interaction frequency allows for Flooding attacks.

The Pizzy Library by MIA Technology Inc. has a vulnerability related to improper access control and missing authorization, allowing exploitation of incorrectly configured access control security levels.

Multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. An attacker can exploit this to force allocation of deeply nested object structures, consuming CPU and memory.

CVE-2026-49111 in ThemeGrill Masteriyo - LMS has an incorrect privilege assignment vulnerability that allows privilege escalation.

The Stiofan GetPaid vulnerability involves the insertion of sensitive information into sent data, allowing for the retrieval of that data later.

A vulnerability in WP Engine Faust.Js allows authentication bypass via an alternate path or channel, enabling password recovery exploitation.

The WordPress Sliced Invoices plugin version 3.8.2 contains an authenticated SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

The CherryFramework theme for WordPress version 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

The WordPress appointment-booking-calendar plugin version 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent XSS payloads through the admin.php page parameters.

The WordPress Plugin HB Audio Gallery Lite version 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.

WordPress Simple-Backup version 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php.

The WordPress Ultimate Product Catalog plugin version 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality.

The Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

The BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.