CVE Vulnerability Catalog

In the Linux kernel binder module, a vulnerability exists where the LSM context size field is read after being zeroed by release. This inflates the scatter-gather buffer end offset, allowing copies to overwrite the secctx area.

In the Linux kernel ksmbd (SMB) server, FSCTL operations such as SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION operate on an open SMB handle but call VFS helpers with the current ksmbd worker credentials. This can lead to revalidation of inode permissions, ownership, and LSM policy independently of the SMB handle access mask. The fix runs each operation with the credentials captured in the target file when the handle was opened.

In the Linux kernel, the ueagle-atm driver (USB ATM) has a vulnerability due to not waiting for the completion of asynchronous firmware loading in the .disconnect() function. This can lead to a race condition when the device is unplugged, potentially causing kernfs errors and system crashes.

In the Linux kernel liveupdate (luo) mechanism, there is a lack of session type validation before performing ioctl operations. Some operations, such as PRESERVE_FD, are only applicable to outgoing sessions, while RETRIEVE_FD and FINISH are only valid for incoming sessions. Calling an invalid ioctl on a session can cause handlers to run in an unexpected context, leading to errors and WARN() warnings. The fix adds session type validation before dispatching the ioctl handler.

The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.

The Backup Migration WordPress plugin before version 2.1.7 does not properly restrict a post-restore automatic login mechanism. A user who administers one site of a multisite network can obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before version 13.5.7 does not perform an authorization check on one of its REST read routes. This allows unauthenticated users to disclose a store's feed configuration (rules, filters, field mapping) and to enumerate the full product category taxonomy.

The Simply Schedule Appointments WordPress plugin before version 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see. This allows users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

The ECS WordPress plugin before version 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor). A Contributor can write a data-source binding into any post, including admin-authored pages, whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.

The ECS WordPress plugin before version 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions. This allows unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

The Groundhogg plugin for WordPress up to version 4.5.14 is vulnerable to SQL injection via the tag_query parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information. Exploitation requires triggering the Legacy_Contact_Query code path via an unknown filter type.

The Beaver Builder Page Builder plugin for WordPress up to version 2.10.2.2 is vulnerable to stored cross-site scripting via the Button Code setting in the Button Module. Insufficient input sanitization and output escaping allow authenticated attackers with author-level access to inject arbitrary scripts that execute when a user accesses an injected page.

The Contest Gallery plugin for WordPress up to version 30.0.7 is vulnerable to second-order SQL injection via the cg_multiple_files_for_post and cgRealId parameters. Insufficient escaping and lack of query preparation allow authenticated attackers with author-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via JSON keys/values patterns. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via the 'key' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Form Maker by 10Web plugin for WordPress up to version 1.15.44 is vulnerable to blind SQL injection via the '{username}' placeholder in a dynamic-choice field. Authenticated attackers with subscriber-level access can append additional SQL queries to extract sensitive information from the database.

The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.

The KiviCare plugin for WordPress up to version 4.5.1 is vulnerable to generic SQL injection via the 'searchTerm' parameter. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.