CVE Vulnerability Catalog

The WP Document Revisions plugin for WordPress (versions up to and including 3.7.2) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

ADB (Android Debug Bridge) is affected by a type privilege bypass; successful exploitation may affect service availability.

A vulnerability was detected in code-projects Student Information System 1.0 in the file /profile.php. Manipulation of the firstname/lastname arguments leads to cross-site scripting (XSS). The exploit is publicly available and can be used remotely.

A vulnerability in Soda PDF Desktop during PDF file parsing allows out-of-bounds read and information disclosure. It requires user interaction (visiting a malicious page or opening a malicious file). It can be exploited in conjunction with other vulnerabilities to execute code.

Under certain circumstances, an attacker can capture the network key and read or write encrypted packets on the PowerG network.

A security flaw has been discovered in CouchCMS up to 2.4, affecting the file couch/config.example.php of the reCAPTCHA Handler component. Manipulation of the K_RECAPTCHA_SITE_KEY/K_RECAPTCHA_SECRET_KEY arguments results in use of a hard-coded cryptographic key. The attack can be launched remotely, is characterized by high complexity, and the exploit has been released to the public.

A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0 in the file /admin/bwdates-reports-details.php. Manipulation of the fromdate argument can lead to cross-site scripting (XSS). The attack can be launched remotely, and the exploit is publicly available.

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. The check_filesystem_permissions() function does not properly restrict the directories that can be created or their location, allowing authenticated attackers with Administrator-level access to create arbitrary directories.

A vulnerability was found in Open5GS up to version 2.7.5 in the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the PFCP component. Manipulation results in improper initialization. The attack can be launched remotely but is difficult to exploit.

A vulnerability was found in Open5GS up to version 2.7.6 in the functions ogs_pfcp_pdr_find_or_add, ogs_pfcp_far_find_or_add, ogs_pfcp_urr_find_or_add, and ogs_pfcp_qer_find_or_add in the library lib/pfcp/context.c. Manipulation leads to a reachable assertion. The attack can be initiated remotely but is difficult to exploit.

A flaw was found in Open5GS up to version 2.7.5 in the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the FAR-ID Handler component. Manipulation leads to null pointer dereference. The attack may be performed remotely but is difficult to exploit.

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Microsoft Edge (Chromium-based) Spoofing Vulnerability.

ImageMagick before version 7.1.1-14 crashes when processing a crafted TIFF file. Version 7.1.1-14 fixes the issue.

A flaw in ZZCMS 2025 affects an unknown functionality in the file /reg/user_save.php of the User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation is possible. The exploit has been published.

A permissions issue was addressed with additional restrictions in Apple systems. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to identify what other apps a user has installed.

A race condition was addressed with improved state handling. Processing maliciously crafted web content may lead to an unexpected process crash.

Mattermost Desktop App versions earlier than 6.0.0 fail to enable Hardened Runtime when packaged for Mac App Store. This allows an attacker to inherit TCC permissions by copying the binary to a tmp folder.

Mattermost versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, 10.12.x <= 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy (version 1) protocol or when the confirming party does not provide a refreshed token. This allows an attacker who has obtained an invite token to authenticate as the remote cluster and perform limited actions on shared channels even after the invitation has been legitimately confirmed.

Mattermost Desktop App versions earlier than 6.0.0 fail to sanitize sensitive information from logs and clear data on server deletion. An attacker with access to the user's system can gain access to potentially sensitive information by reading application logs.