CVE Vulnerability Catalog

The WCFM – Frontend Manager for WooCommerce plugin for WordPress (up to version 6.7.25) has an Insecure Direct Object Reference (IDOR) vulnerability in multiple AJAX actions. Missing validation on user-supplied object IDs allows authenticated attackers with Vendor-level access or higher to modify any order, delete or modify any post/product/page regardless of ownership.

Electron versions from 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8 contain a context isolation bypass vulnerability. Apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable. An attacker who can execute JavaScript in the main world (e.g., via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script.

PraisonAI before version 4.5.97 contains a vulnerability in SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED). The subprocess.run() function is called with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

Electron before versions 39.8.1, 40.7.0, and 41.0.0 has a use-after-free vulnerability in apps using offscreen rendering and allowing child windows via window.open(). Destroying the parent WebContents while a child window is open can lead to a crash or memory corruption.

Electron prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8 is vulnerable to a use-after-free when handling fullscreen, pointer-lock, or keyboard-lock permission requests if the app registers an asynchronous `session.setPermissionRequestHandler()`. If the requesting frame navigates or the window closes while the permission handler is pending, invoking the stored callback dereferences freed memory, which may lead to a crash or memory corruption.

Electron before versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8 contains a use-after-free vulnerability in the powerMonitor module. After the PowerMonitor object is garbage-collected, OS resources retain dangling references, leading to crashes or memory corruption on session events (Windows) or system shutdown (macOS).

Electron prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8 has an undocumented commandLineSwitches webPreference that allows arbitrary switches to be appended to the renderer process command line. Apps constructing webPreferences from untrusted configuration objects may allow an attacker to disable renderer sandboxing or web security controls.

In PraisonAI before version 1.5.95, the FileTools.download_file() function does not validate the URL parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker controlling the URL can reach any host accessible from the server, including cloud metadata and internal services.

PraisonAI before version 1.5.90 contains a command injection vulnerability in the run_python() function. The function constructs a shell command from user input without proper escaping, allowing arbitrary OS command execution before Python is invoked.

PraisonAI prior to version 4.5.90 has a vulnerability in passthrough() and apassthrough() functions that accept a caller-controlled api_base parameter. This parameter is concatenated with the endpoint and passed to httpx.Client.request() without URL scheme validation, private IP filtering, or domain allowlist, allowing requests to any host reachable from the server. The issue has been fixed in version 4.5.90.

Mesop, a Python-based UI framework, from version 1.2.3 to before version 1.2.5 contains an uncontrolled resource consumption vulnerability in the WebSocket implementation. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of OS threads, leading to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS).

In Emlog versions 2.6.2 and prior, a path traversal vulnerability exists in the emUnZip() function, allowing an authenticated admin to write arbitrary files (including PHP webshells) by extracting a crafted ZIP archive with ../ sequences, leading to Remote Code Execution (RCE). No public patch available.

In nimiq/core-rs-albatross (a Rust implementation of the Nimiq Proof-of-Stake protocol) prior to version 1.3.0, the handshake handler accepts a peer-supplied limit of 0 and stores it unchanged. In the HandshakeAck path, limit 0 returns zero contacts, appearing benign. Later, in the Established state, computing self.peer_list_limit.unwrap() as usize - 1 with limit 0 wraps to usize::MAX, causing a panic when attempting memory allocation.

A vulnerability in Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations.

OpenPrinting CUPS versions 2.4.16 and earlier contain a vulnerability that allows a local unprivileged user to coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable `Authorization: Local ...` token. This token enables /admin/ requests on localhost, and the attacker can create a persistent printer queue with a file:///... URI despite the FileDevice policy. Printing to that queue allows arbitrary root file overwrite, potentially leading to privilege escalation.

OpenPrinting CUPS versions 2.4.16 and prior have a vulnerability in a network-exposed cupsd with a shared PostScript queue. An unauthenticated client can send a print job, and the server processes a page-border value with an embedded newline, allowing execution of an arbitrary binary (e.g., /usr/bin/vim) as user lp.

OAuthenticator before version 17.4.0 has an authentication bypass vulnerability. An attacker with an unverified email address on an Auth0 tenant can log in to JupyterHub, and if email is used as the username, they can take over accounts.

RAGFlow versions up to 0.24.0 contain a Server-Side Template Injection (SSTI) vulnerability in the TextProcessing and Message components. It allows an authenticated user to execute arbitrary OS commands on the server via unsafe Jinja2 template rendering.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the Activity List API endpoint. An authenticated administrator can extract sensitive data from the database, including user credentials, email addresses, and all stored content.

Piwigo prior to version 16.3.0 contains a SQL Injection vulnerability in the pwg.users.getList API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands.