CVE Vulnerability Catalog

The WordPress plugin 'PlanetStudio Payment Gateway' (versions up to 1.3.3) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Infinite Uploads' (versions up to 3.4.1) has an insertion of sensitive information into sent data vulnerability, allowing retrieval of embedded sensitive data.

The WordPress plugin 'Ajax Search Lite' (versions up to 4.14.5) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The undici library (versions 5.15.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its WebSocket client that allows a malicious server to exhaust process memory by sending PING frames without reading PONG responses, causing unbounded growth of the outbound write queue and heap.

The undici library (versions 6.5.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its EventSource client that allows a malicious server to exhaust process memory by sending millions of tiny completed data fields without a blank event separator, or a single unfinished line split across many chunks, causing unbounded parser state accumulation beyond byte limits.

The WordPress plugin 'Strong Testimonials' (versions up to 3.3.12) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

The undici library (versions 7.15.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its fetch() implementation that verifies Subresource Integrity (SRI) metadata by matching the algorithm token against a lowercase-only set, so a valid but non-lowercase token (e.g., uppercase SHA256) is treated as unknown and skipped, causing the response to be accepted without integrity check.

The Sunshine Photo Cart plugin for WordPress (up to version 3.7.4) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user can access functionality that should be protected.

In the Ansible Automation Platform UI (Hub module, DocumentationParsers.tsx), documentation links are rendered without restricting the URL protocol/scheme. A collection with a link using a script-executing scheme can cause script execution in the browser of another authenticated user who clicks it — a stored XSS issue.

The Knowledge Base plugin by WebberZone (up to version 3.2.0) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can access protected functionality.

temporal-proxy versions 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. The proxy selects the decryption key based on an identifier in the payload rather than the request namespace, allowing an attacker authorized for namespace B to decrypt a payload from namespace A.

ELADMIN version 2.7 and earlier is vulnerable to Cross Site Scripting (XSS) via the WebSocketServer, SpringSecurityConfig, and deploy.vue components. Improper input neutralization allows injection of malicious script.

The YITH WooCommerce Compare plugin (up to version 3.15.0) has an improper neutralization of input during web page generation vulnerability, leading to stored XSS. A malicious script can be persistently stored and executed in the user's browser.

The bandit library (versions 0.6.0 to 1.13.0) improperly validates syntactic correctness of input. An unauthenticated remote attacker can set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target, potentially injecting malicious values into URLs generated by the application.

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (up to version 1.5.3) has an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

OpenPrinting CUPS before version 2.4.20 has a flaw in copy_banner() that uses the attacker-controlled attributes-natural-language value as a directory component. This allows escaping the banner directory and copying an arbitrary file into a spool object that can be delivered to the attacker.

Helium before version 2.2.60 allows any authenticated user to submit an arbitrary URL to POST /feed/externalcalendars/. The server uses validate_url only to check syntax, then fetches the URL via urllib.request.urlopen, enabling forced outbound requests and internal service reconnaissance.

In OpenPrinting CUPS, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory, predict the connection-derived name, and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). Fixed in version 2.4.20.

In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.