CVE Vulnerability Catalog

Improper Neutralization of CRLF Sequences in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through comments. Ymlr.document!/2 interpolates comments without validation, allowing injection of newlines and fake keys. Affects versions from 0.0.1 before 5.1.6.

In the SAML protocol implementation of Keycloak, when a client is configured with a wildcard redirect URL, an attacker can craft a request with malicious parameters. After user authentication, Keycloak appends its legitimate response to the attacker's parameters, potentially causing the service provider to process the attacker's data instead of real login information, leading to user login to the wrong account.

In the keycloak-services component of Keycloak, the security check preventing HTTP parameter pollution only inspects the query portion of a redirect URL, ignoring the fragment. When a client is configured with a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. If the client application is not configured correctly, it might trust the attacker's injected data instead of real security information from Keycloak, leading to session fixation or account confusion.

In Keycloak's keycloak-services component, a realm administrator can use a wildcard domain (e.g., *.example.com) to restrict client registration. Due to improper validation, the system accepts any hostname ending with the domain suffix, even if not a legitimate subdomain. An attacker controlling reverse DNS can bypass these restrictions and potentially make unauthorized client modifications.

The WP Go Maps WordPress plugin before version 10.1.04 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The FluentCart WordPress plugin before version 1.5.3 lacks authorization and ownership checks when rendering customer order documents keyed on sequential numeric identifiers. Unauthenticated visitors can enumerate and disclose customer personal data (names, email addresses, billing and shipping addresses, order details) across the store.

The Support Genix WordPress plugin before version 1.4.48 improperly authorizes access to support-ticket attachment downloads. Unauthenticated users who know the stored attachment file name can download other users' private ticket attachments.

The Paid Membership Subscriptions WordPress plugin before version 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory. Unauthenticated users can download these files, containing personal data (PII), while an export artifact is present.

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing and outputting them, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript. On a multisite network, this lets a non-super subsite Administrator plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

Node.js versions 22.x, 24.x, and 26.x have a vulnerability in the Permission Model that allows process.report to write (and overwrite) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary.

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

The Spring Boot language server logs the raw value of proxy environment variables (https_proxy, etc.) at INFO level when no http.proxy setting is configured. Proxy URLs often contain Basic-auth credentials, which are written without redaction.

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() to write trace logs outside the --allow-fs-write boundary.

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on public submission handlers. Unauthenticated users can submit entries to deactivated or unpublished forms and trigger configured workflows like email notifications.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks capability and nonce checks in a connection-deletion action, allowing contributor-level users to delete booking configuration and disable the booking system.

A vulnerability in the Easy Appointments WordPress plugin through 4.0 lacks capability checks in appointment-management actions, relying only on a nonce, allowing contributor-level users to read all customers' appointment details and to create, modify, and delete bookings.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks per-request capability and nonce checks on a customer-listing handler, allowing authenticated contributor-level users to read all stored customers' personal information.

Inappropriate implementation in Chrome for iOS on iOS devices prior to version 151.0.7922.72 allows a local attacker to obtain potentially sensitive information from process memory via physical access to the device.

Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.