CVE Vulnerability Catalog

Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 versions up to 2.1.3.

Subscriber PHP Object Injection in Export User Data versions up to 2.2.6.

Contributor Remote Code Execution (RCE) in Betheme versions up to 28.4.2.

Unauthenticated SQL Injection in Qode Tours versions up to 3.1.3.1.

Unauthenticated SQL Injection vulnerability in WP OAuth Server versions up to 6.2.0.

Unauthenticated SQL Injection vulnerability in Simply Schedule Appointments versions up to 1.6.12.10.

Unauthenticated Privilege Escalation vulnerability in AIWU versions up to 1.5.6.

Sensitive Information Disclosure vulnerability in Dell Virtual Storage Integrator for VMware vSphere Client prior to version 10.11.1.0. An unauthenticated remote attacker could exploit this, leading to information disclosure and session hijacking.

Path traversal vulnerability in OpenChamber 1.11.7 in file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw, allowing unauthenticated remote attackers to read arbitrary files by supplying allowOutsideWorkspace=true and an absolute path, bypassing workspace boundary check.

Unauthenticated remote code execution vulnerability in OpenChamber 1.11.7, allowing remote attackers to execute arbitrary shell commands by sending crafted POST requests to /api/fs/exec, which passes commands verbatim to Node.js spawn() without validation.

An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Unauthenticated PHP Object Injection vulnerability in Ajax Search Lite versions up to 4.14.4.

Unauthenticated Privilege Escalation vulnerability in Kadence WooCommerce Email Designer versions up to 1.5.19.

SQL Injection vulnerability in Loca Software Informatics Technology Ltd. Co. CMS due to improper neutralization of special elements in an SQL command. The issue affects CMS through 06082026.

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console, leading to full unauthenticated takeover of the GlassFish domain until the token expires.

In Apache CXF's DefaultEncryptingCodeDataProvider, an authorization code can be redeemed an unlimited number of times due to a flaw in the removeCodeGrant implementation. This violates the RFC requirement that the authorization code must not be used more than once. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

Apache CXF's OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens. Note that self-issued ID tokens are not accepted by default. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT can substitute code_challenge, code_challenge_method, nonce, and state values, undermining PKCE integrity and OpenID Connect replay protection. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are advised to upgrade to versions 4.2.3, 4.1.8, or 3.6.12.