CVE Vulnerability Catalog

The MailMunch – Grow your Email List plugin in versions up to and including 3.2.5 contains a broken authentication flaw that allows a subscriber-level user to bypass access controls.

The WP Docs plugin in versions up to and including 2.3.1 is vulnerable to Cross Site Scripting (XSS) that can be performed by a Subscriber-level user. The injected script may execute in another user's browser.

The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.

The Robokassa payment gateway for WooCommerce in versions up to and including 1.8.9 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. Missing proper access control enables unauthorized operations.

The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 contains a Bypass vulnerability exploitable by an unauthenticated attacker. This allows circumvention of the protection mechanism provided by the plugin.

The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 is vulnerable to Content Injection that can be performed by an unauthenticated attacker. This allows unwanted content to be placed in the site's context.

Suricata is a network IDS, IPS, and network security monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio (e.g., gzip, deflate, brotli) could cause excessive memory allocation during decompression.

Suricata is a network IDS, IPS, and network security monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service.

The Sierra Wireless HL78xx modem GNSS driver contains a type confusion bug — the gnss_nmea0183_match_data struct is not the first member of hl78xx_gnss_data, so the NMEA parser callbacks (GGA/RMC/GSV) read and write data at a shifted offset. As a result, the GSV callback performs a write through an uninitialized pointer with a garbage bound, potentially causing a kernel crash (DoS) and, on MMU-less targets, adjacent-memory corruption.

MISP version ≤2.5.45 contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which renders MISP element references (attributes, objects, and tags) into inline HTML during PDF report export. User-controlled fields (attribute type and value, object name and relation, tag name and colours) are interpolated into HTML templates without HTML entity encoding. Additionally, the attribute() method contains hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, causing every plain attribute reference in a PDF to display the sample text rather than the actual indicator value.

MISP in versions up to and including 2.5.45 does not consistently enforce the acting user's authorization when instantiating event templates. The instantiation path passed a template-specified sharing_group_id into event creation without verifying the user could use that sharing group, attached template-specified tags without checking tagging permissions, and hardcoded local => 0, allowing local_only tags to be attached globally and propagate through synchronization or export.

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services.

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. An attacker who obtains an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check. The issue is fixed in Snipe-IT 8.7.2.

OpenPanel through 2.3.0 share lookup procedures fail to validate access controls, allowing unauthenticated callers with a share link to retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions.

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard. An authenticated organization member can make the server connect to any address reachable from it, and the resulting HTTP status is persisted as an error message, providing a scanning oracle for internal hosts, ports and paths.

OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules.

OpenPanel through 2.3.0 has an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII.

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySource=docker mode.

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.