CVE Vulnerability Catalog

The Masteriyo - LMS plugin in versions up to and including 3.4.0 contains an Unauthenticated PHP Object Injection vulnerability. An attacker can inject a malicious PHP object, potentially leading to further attacks such as remote code execution.

The SMS Alert Order Notifications plugin in versions up to and including 3.9.9 contains a Subscriber Privilege Escalation vulnerability. A user with the subscriber role can elevate their privileges, gaining access to functions reserved for higher roles.

Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.

Unauthenticated PHP Object Injection in Everest Forms versions 3.6.0 and below.

The Gato GraphQL plugin in versions up to and including 19.2.3 contains a vulnerability allowing a subscriber to escalate their privileges. A low-privileged user can gain access to functionality reserved for higher roles.

The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.

The 10up ElasticPress plugin in versions up to and including 5.3.4 contains an Insertion of Sensitive Information Into Sent Data vulnerability. This may allow retrieval of embedded sensitive data.

In Authorizer prior to version 2.2.1, the /authorize endpoint accepts any redirect_uri without validating it against AllowedOrigins. With response_type=token or response_type=id_token, the server appends access_token, id_token, and refresh_token as query parameters and issues a 302 redirect to the attacker-supplied URL. An unauthenticated attacker can obtain the client_id from the public /graphql endpoint.

The Deposits and Partial Payments for WooCommerce plugin in versions up to and including 3.1.0 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.

The Website Template by Arma Digital Media Inc. contains an Improper neutralization of special elements used in a template engine vulnerability. This may allow Code Injection. The issue affects versions through 11092026. The vendor was contacted but did not respond.

A race condition in the document value layer of MongoDB Server allows concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user with ordinary read-write privileges on a database can trigger this condition over the normal client protocol.

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 allows an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice, and for one of the calls the return value was ignored, which may lead to improper extraction of a member.

The built-in name-finder patterns EMAIL and URL in Apache OpenNLP contain ambiguous nested quantifiers, enabling a ReDoS attack. A crafted input can trigger super-linear backtracking or unbounded matcher recursion, leading to CPU exhaustion or StackOverflowError. The issue affects versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5.

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. The scripts are rendered in reporting views and execute in the browser sessions of teachers or administrators.

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php). It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can pass any block ID on the site, causing the source block's content to be duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request.

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of view permissions.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: before 8.4.2.0.

In wpa_supplicant all versions before 2.12, a missing validation in the driver-based PMKSA selection path in wpa.c allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching.