CVE Vulnerability Catalog

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

The report.list procedure in Reconmap's trpc package accepted a projectId and a dashboardId, but only verified membership for the supplied projectId, not that the dashboardId belonged to that project. An authenticated user could pair a projectId from their own organization with a dashboardId from another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed but was not used by the router.

The report.get procedure in the TRPC router accepts only a reportId and returns getReportById(reportId) without access checks. The enforceAccess middleware only evaluates membership when the input carries a projectId or organizationId key, so a reportId alone passes through unchecked. An authenticated user can read the full configuration of any saved report, including projectId, event series, filters, breakdowns, and formulas.

Reconmap's API applies a fallback authorization policy requiring an authenticated administrator, but the report preview action in ReportsController.cs carries [AllowAnonymous], opting out of that policy. PreviewReport loads the project and linked organisation without any authentication, membership, or role check. Because the id is an auto-increment primary key, an unauthenticated attacker can walk sequential ids to retrieve sensitive details of all projects.

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derives every operation's target from path(key) without checking that the result stays within the root. Object keys from an external store can contain traversal segments, allowing writes outside the intended local directory with no error. An operator syncing from a not fully controlled bucket is exposed to file writes at attacker-influenced locations.

A vulnerability in the misp-stix library stems from incomplete clearing of parser state between STIX document conversions. Reusing the same parser instance can cause data from a previously processed document (e.g., galaxies, DNS records, titles, timestamps) to be incorporated into the MISP event generated from a subsequent document. The issue affects both STIX 1 and STIX 2 parsers.

A weakness has been identified in Dolibarr up to 23.0.4 in the file htdocs/user/card.php of the Account Handler component. Manipulation of the ID argument causes improper authorization. The attack can be initiated remotely, and the exploit is publicly available. Upgrading to version 24.0.0 mitigates the issue.

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1, affecting the system function in /cgi-bin/mbox-config?method=SET&section=ntp_timezone. Manipulation of the timestr argument results in command injection. The attack can be launched remotely and the exploit has been publicly released.

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal. Attackers with admin access can write arbitrary files or recursively delete directories by supplying crafted packageName values.

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform. The vulnerability affects Micrometer versions 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.

Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory, granting FULL CONTROL to the Everyone group. A Windows service running as SYSTEM loads DLLs from this directory. A race window exists when the service is stopped, during which a local unprivileged attacker can replace a DLL with a malicious payload, which executes as SYSTEM upon service restart.

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The import code used sys.exit() to handle errors, causing unexpected process termination, and did not limit input size, leading to excessive memory and CPU consumption.

A path traversal vulnerability in MISP during STIX 2 import and MISP-to-STIX 2 export. MISP object names were not sufficiently validated before being used in filesystem paths for template resolution, allowing escape from the template directory and loading a definition.json from another location. An attacker could supply a malicious object name (e.g., containing ../) via a custom STIX object or a persistent MISP event.

A vulnerability was identified in CodeAstro Online Job Portal 1.0 in the file /users/update-profile.php. Manipulation of the Name argument leads to unrestricted upload. The attack can be initiated remotely, and the exploit is publicly available.

Applications using Micrometer Tracing with W3C baggage propagation in the Brave bridge are vulnerable to denial of service (DoS) due to unbounded object allocation when extracting incoming baggage headers. Affected versions: Micrometer Tracing 1.7.0, 1.6.0-1.6.6, 1.5.0-1.5.12, and 1.4.13 and earlier.