CVE Vulnerability Catalog

The Grav API plugin before 1.0.18 does not enforce API-key scope caps in the injectSecurityTab() function of BlueprintController. A caller with a scoped API key may see and potentially edit page permission fields beyond the granted scope.

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

An attacker with network access could exploit an Improper Access Control vulnerability in UniFi Protect AI Key to escalate privileges on the device.

An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Talk Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in UniFi Access Application to escalate privileges on the host device.

An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

An attacker with network access and under certain conditions could exploit an Improper Access Control vulnerability in UniFi Connect Display Cast Pro to escalate privileges on the device.

An attacker with network access could exploit an Improper Neutralization of CRLF Sequences vulnerability in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

An attacker with network access and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Protect Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.

An attacker with access to an adjacent network can exploit a buffer overflow vulnerability in the DHCPv6-enabled EdgeMAX EdgeSwitch, leading to remote code execution on the device.

The Greenshift – animation and page builder blocks plugin for WordPress up to version 12.8.9 has a Stored Cross-Site Scripting vulnerability in the customapi action handler. Insufficient sanitization of API responses before output via innerHTML allows authenticated attackers with Contributor-level access to inject arbitrary scripts.

The WP Data Access plugin for WordPress up to version 5.5.68 has an Insecure Direct Object Reference vulnerability in the check_app_access function. Missing validation on a user-controlled key allows unauthenticated attackers to access data from protected app containers.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress (up to version 1.17.8) is vulnerable to unrestricted file upload via the save_attachments() function. Missing file extension validation and path normalization allow unauthenticated attackers to write malicious PHP outside the .htaccess-protected directory, potentially leading to remote code execution if PHP executes in uploads.

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.

TarsWeb trusts a client-controlled X-Forwarded-For header, allowing an attacker to impersonate a local caller. By forging a loopback address and providing a uid of an existing account, an attacker can access the console as any user, including administrator, without credentials. Version 3.0.16 fixes this.

TarsWeb fails to enforce access control in four methods of PatchController, allowing any authenticated user to upload packages, trigger deployments on any server, retrieve/delete other applications' packages, and change the default package.

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a bracketed value, so the branch holding the private-address checks is skipped entirely. The guard falls back to resolving the hostname, the bracketed string is not a resolvable name, no addresses are returned, and the target is reported safe. The HTTP client then strips the brackets and connects. Because the address may be given in IPv4-mapped form, the same path reaches any IPv4 target the loopback and private checks were meant to exclude, including link-local metadata endpoints. isPrivateIPv6 also has no case for the ::ffff: prefix, so the mapped form would still pass even if the brackets were removed. The fetch target is supplied as a tool argument, so an attacker who can influence what the model requests can read internal responses back into the model context.