CVE Vulnerability Catalog

The playlistsFromUser.json.php endpoint in WWBN AVideo contains a missing authorization vulnerability. Unauthenticated attackers can read private playlists by requesting another user's identifier, including Favorite and Watch Later playlists, due to improper cache keying that conflates requests across different user contexts.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint. An unauthenticated attacker can call adsInfo with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without any permission checks.

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint, which accepts user-supplied chatflowId and chatId without ownership verification. An attacker can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers.

Flowise versions up to and including 3.1.3 mount the POST /api/v1/node-load-method/:name endpoint without any route-level permission check and invoke component loadMethods with attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace. An authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace, causing Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record, including the bcrypt password hash and temporary tokens. An attacker can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking.

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. An authenticated attacker with Contributor-level access and above who can use Elementor can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044 through A, AN953 through A, and SW300052 through 2.6.

The GEO my WP plugin for WordPress in all versions up to and including 4.5.5.3 is vulnerable to Local File Inclusion via the gmw_posts_locator_ajax_info_window_loader function. This enables unauthenticated attackers to include and execute arbitrary .php files on the server, allowing execution of any PHP code in those files, bypassing access controls, obtaining sensitive data, or achieving code execution. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress in all versions up to and including 4.2.1 is vulnerable to generic SQL Injection via URL Path due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables authenticated attackers with subscriber-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database. It is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.7) is vulnerable to PHP Object Injection via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. The handler lacks capability or role checks, relying solely on a nonce, and passes attacker-supplied values through `esc_sql()`, causing serialized string length mismatches that allow injection of an arbitrary serialized object stream. An authenticated attacker with subscriber-level access or above can achieve remote code execution via the `GuzzleHttp\Cookie\FileCookieJar` POP chain, with an unauthenticated pathway when user registration is enabled.

The Events Calendar plugin for WordPress in all versions up to and including 6.17.3 is vulnerable to Remote Code Execution via the parse_array function. Insufficient validation of the widget 'classes' map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This enables unauthenticated attackers to execute code on the server, provided comments are enabled on tribe_events posts and at least one comment containing a crafted wp:legacy-widget block has been submitted.

The Events Calendar plugin for WordPress in all versions up to and including 6.17.4 is vulnerable to Remote Code Execution via the is_safe_widget_instance function. Insufficient protection in is_safe_widget_instance can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This enables unauthenticated attackers to execute code on the server, as the plugin's V2 single-event template runs do_blocks() over buffered comment HTML and WordPress returns a moderation-hash URL allowing an unauthenticated commenter to immediately view their own pending comment.

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. An authenticated attacker with subscriber-level access or above can append additional SQL queries into existing queries to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled and the egoi_mapping option to be truthy.

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. An unauthenticated attacker can extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, so no authenticated session or prior action is needed.

The rtMedia for WordPress, BuddyPress and bbPress plugin in all versions up to and including 4.7.11 is vulnerable to time-based blind SQL Injection via the 'compare' parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables unauthenticated attackers to append additional SQL queries into existing queries to extract sensitive information from the database. It is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys.