CVE Vulnerability Catalog

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details, including arbitrary user passwords, to a known plugin-configured custom value. This makes it possible for authenticated attackers with subscriber-level access and above to change arbitrary users' email addresses, including administrators, and reset their passwords.

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API parameters (interval, format, emailTo) in all versions up to and including 3.0.3 due to insufficient input sanitization and output escaping. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of files with dangerous types. If exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code execution.

BurgerEditor versions 3.0.0 through 3.4.0 contain an authorization bypass issue through a user-controlled key. If exploited, an attacker who can log in to the product may alter page content.

Velociraptor creates notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query that will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

Velociraptor allows some sensitive artifacts to be gated by additional permissions, e.g. Linux.Sys.BashShell requires EXECVE. However, no such check was implemented for client monitoring artifacts, and there was no requirement that they carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts.

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in is_file_type_valid(), which uses the attacker-controlled 'type' parameter as regex keys in the MIME allowlist, allowing blacklist bypass. This makes it possible for unauthenticated attackers to upload executable files and achieve remote code execution.

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free, and the attack may be launched remotely. The exploit has been made public and could be used, and the pull request to fix this issue awaits acceptance.

A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearable up to 20260707. Impacted is an unknown function of the Apple Notification Center Service Event Handler component. The manipulation leads to buffer overflow, and the attack must be carried out from within the local network. The vendor was contacted but did not respond.

A cross-site scripting (XSS) vulnerability was found in the Rizwan17 inventory-management-system in the index.php file of the Login Page component. Manipulating the msg argument allows script injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was detected in Rizwan17 inventory-management-system in the storeCustomerOrderInvoice function of includes/manage.php. Manipulation of the pro_name[] argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.

A security vulnerability in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f affects the file includes/invoice_bill.php in the Invoice Generation component, where manipulation of arguments order_date/invoice_no leads to missing authentication, allowing remote attack.

In the inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f, a cross-site scripting vulnerability was found in includes/DBOperation.php of the List Handler component. Manipulation of category_name/brand_name/product_name arguments allows remote attack. The exploit is public, and the project has not responded.

In Siam Ordering (siam-server) version 1.0.0, there is an authentication bypass vulnerability via a hardcoded master verification code. Remote unauthenticated attackers can log in as any user, merchant, or administrator.

A vulnerability in the Bluetooth Classic (BR/EDR) stack in Zephyr RTOS affects the L2CAP receive handler, which dispatches inbound data PDUs based only on the destination channel ID without verifying that the channel has reached the BT_L2CAP_CONNECTED state. An attacker within radio range can send data to a channel during connection setup, before configuration and authentication complete. This can lead to delivery of attacker data to upper-layer protocols on a half-open channel and to use of stale or partially initialized channel state, causing denial of service or a potential dangling-pointer condition.

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker able to submit a malicious file for analysis could use path traversal sequences or crafted paths to cause extracted content to be written outside the designated extraction directory, potentially overwriting files accessible to the Pandora worker process.

Open WebUI from 0.5.0 to 0.11.1 has a vulnerability causing infinite loop in the message-chain reconstruction helper in backend/open_webui/utils/misc.py. An authenticated user can store id-less messages in a cyclic structure, blocking the event loop and growing memory until termination. Fixed in 0.11.1.

Open WebUI from 0.9.5 to 0.11.1 fails to reapply WEB_FETCH_FILTER_LIST or private-address controls to HTTP redirect destinations when AIOHTTP_CLIENT_ALLOW_REDIRECTS is enabled. An authenticated user can redirect fetches to excluded hosts, loopback, private networks, or cloud metadata services, and route content into various features. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 has an infinite loop vulnerability in the chat deletion helper in backend/open_webui/models/chats.py. An authenticated user can create a cyclic chat tree and delete a message, causing a synchronous infinite loop that blocks all user requests until process termination. Fixed in 0.11.1.

Open WebUI prior to 0.11.1 in POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject.