CVE Vulnerability Catalog

Delta Electronics DVP12SE PLCs are vulnerable to an unlimited resource allocation attack in their Modbus TCP service. The lack of limits or throttling can lead to resource exhaustion.

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to and including 2.2.6. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The WP Support Plus Responsive Ticket System WordPress plugin up to version 9.1.2 does not sanitize user-supplied array keys before using them in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.

The WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2 fails to properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.

The Kali Forms WordPress plugin before 2.4.13 does not sanitize a form field's caption before outputting it as a column header on the admin form-entries screen. Users with Contributor-level access or above can inject JavaScript that executes in an administrator's session. A missing capability check in the post-duplication action allows the Contributor to publish the malicious form so an administrator renders it.

The Plugin for Google Analytics by IO technologies for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.1. This is due to missing or incorrect nonce validation on the Google Analytics settings page (ga.php), allowing unauthenticated attackers to update the plugin's stored Google Analytics tracking ID option (io-ga-id) via a forged request, provided they can trick a site administrator into clicking a link.

The Editorial Rating – Product Review & Rating System plugin for WordPress up to version 4.0.5 is vulnerable to Stored Cross-Site Scripting via the 'Link URL' field due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts that execute when users access the affected page.

The Premium Addons for KingComposer plugin for WordPress up to version 1.1.1 is vulnerable to unauthorized modification and data loss. Missing authorization and capability checks in the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers allow unauthenticated attackers to create or delete custom widget areas, potentially causing widgets to silently lose registration and stop rendering.

The ProfileGrid plugin for WordPress up to version 5.9.9.5 contains a privilege escalation vulnerability via account takeover. Lack of validation of the `user_login` parameter in registration forms and improper error handling allow unauthenticated attackers to change the email address of the user account with ID=1 (typically an administrator), then reset the password and gain access.

The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.7.2 via the move_image_on_server function. This allows authenticated attackers with author-level access or above to write files with attacker-controlled content to arbitrary locations on the server.

A Time-of-check time-of-use (TOCTOU) race condition vulnerability has been discovered in Samsung Open Source Escargot. This flaw allows leveraging race conditions to compromise data integrity.

The Team Members – Multi Language Supported Team Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 8.7 inclusive. This is due to insufficient input sanitization and output escaping.

A vulnerability in the rtapi_app component of the linuxcnc-uspace package in LinuxCNC before version 2.9.9 allows privilege escalation. The program is installed SUID root and loads shared library modules via dlopen() using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to load an arbitrary shared library, and because the process retains elevated privileges during module loading, this results in local privilege escalation to root.

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` only checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after validation, allowing an attacker to bypass the protection.

A vulnerability in Zephyr's HTTP server (subsys/net/lib/http) allows an attacker to read arbitrary files outside the configured web root. The issue occurs in static filesystem resource handling (HTTP_RESOURCE_TYPE_STATIC_FS), where the request path is not canonicalized before use, enabling directory traversal via ../ sequences.

A logic error in IPv6 Neighbor Discovery handlers in Zephyr RTOS causes critical checks (Hop Limit == 255, link-local source, multicast sanity) to be bypassed due to incorrect operator precedence. An adjacent or potentially remote attacker can inject forged RA, NS, and NA messages.

A heap buffer overflow vulnerability has been discovered in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 versions 2.3.3 through 2.3.6. An attacker can exploit this to cause a Denial of Service (DoS) by sending a crafted payload.

A heap buffer overflow was discovered in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3. This vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a crafted packet.

In Zephyr RTOS, mcumgr_serial_process_frag() calls net_buf_reset() on the result of smp_packet_alloc() before checking for NULL. When the MCUmgr packet pool (default 4 buffers) is exhausted, smp_packet_alloc() returns NULL, and net_buf_reset() writes through the NULL pointer, causing a system crash. An attacker can flood the serial/UART/shell transport to exhaust the pool and trigger a denial of service.

The Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.