CVE Vulnerability Catalog

Unauthenticated broken authentication vulnerability in the User Registration & Membership Pro plugin. Affects versions up to 5.4.5.

Unauthenticated PHP Object Injection vulnerability in the FundEngine plugin. Affects versions up to 1.7.9.

Subscriber Remote Code Execution (RCE) vulnerability in the Query Wrangler plugin. Affects versions up to 1.5.57.

Unauthenticated SQL Injection vulnerability in the BookingPress Appointment Booking Pro plugin. Affects versions up to 6.0.2.

Unauthenticated privilege escalation vulnerability in the Abandoned Cart Pro for WooCommerce plugin. Affects versions up to 10.4.0.

Unauthenticated SQL Injection vulnerability in the Locatoraid Store Locator plugin. Affects versions up to 3.9.72.

Unauthenticated PHP Object Injection vulnerability in Flatastic versions up to 2.0. An attacker can send crafted data to execute arbitrary code.

Unauthenticated SQL Injection vulnerability in Directory Pro versions up to 2.5.8. An attacker can manipulate database queries.

Unauthenticated SQL Injection vulnerability in TheGem (Elementor) versions up to 5.12.3. An attacker can manipulate database queries.

Author Arbitrary File Upload vulnerability in Media Library Assistant versions up to 3.39. A user with author role can upload malicious files.

Unauthenticated SQL Injection vulnerability in Security & Malware scan by CleanTalk versions up to 2.184. An attacker can manipulate database queries.

Unauthenticated SQL Injection vulnerability in rtMedia for WordPress, BuddyPress and bbPress versions up to 4.7.11. An attacker can manipulate database queries.

Unauthenticated PHP Object Injection vulnerability in Forminator versions up to 1.57.0. An attacker can send crafted data to execute arbitrary code.

Unauthenticated Privilege Escalation vulnerability in Capella versions up to 2.5.5. An attacker can gain higher privileges without logging in.

Unauthenticated SQL Injection vulnerability in Capella versions up to 2.5.5. An attacker can manipulate database queries.

A flaw was found in FreeIPA. When a trust relationship is configured with Active Directory, AD users can bypass authentication for FreeIPA services by impersonating a client name in the TGS due to missing PAC certificate verification. This could allow an authenticated AD user to escalate privileges within the FreeIPA domain.

An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.

The JSON Options WordPress plugin through 0.0.4 lacks capability checks and nonce verification on one action, available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplies those bytes is caller-controlled: p2p_connect passes remote_engine_endpoint_info.zmq_address from the request body to connect() on the ZMQ PULL socket, and the POST /distserve/p2p_initialize and /distserve/p2p_connect endpoints in lmdeploy/serve/openai/api_server.py apply no authentication unless the server is started with api_keys, which defaults to None. A remote attacker can direct an engine to pull from a ZMQ endpoint under their control and execute arbitrary code in the engine process. Deployments that do not enable disaggregated serving are not affected, because the receive loop is only started once the migration backend accepts the connection.

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.