CVE Vulnerability Catalog

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.2.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Events Manager WordPress plugin before version 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, so a cross-user read is not achievable by guessing alone.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the plugin then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information. This allows unauthenticated attackers to deactivate the plugin's premium licensing state and erase the stored license key.

The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes. This allows unauthenticated users to read published entries of custom post types that the site registered as non-public.

The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response. This allows unauthenticated users to read the lifetime number of units sold for any published product.

A vulnerability was identified in JeecgBoot up to 3.9.2 in an unknown function of the file /airag/chat/send of the Anonymous Chat Attachment Parser component, allowing server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 5.0.0. On sites not connected to the WPMU DEV Hub, the API key is empty, making the signature trivially forgeable; version 5.0.0 also removed the replay check. This allows unauthenticated attackers to invoke privileged actions, including installing plugins from attacker-supplied URLs (leading to RCE), deleting plugins, upgrading WordPress, or logging in as admin.

The Forminator Forms plugin for WordPress up to version 1.56.1 is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The FluentSMTP plugin for WordPress up to version 2.2.95 is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator accesses the detail view of logs.

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function. Authenticated attackers with subscriber-level access can read and delete arbitrary files on the server, potentially leading to remote code execution when critical files like wp-config.php are deleted.

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64, affecting an unknown part of the file container/agent-runner/src/mcp-tools/core.ts in the send_file component. Manipulation leads to path traversal, allowing remote attack. The exploit has been publicly disclosed and may be used.

A vulnerability was detected in letta-ai LettaBot 0.2.0, affecting an unknown function in the file src/api/server.ts in the API Status Route component. Manipulation results in missing authentication, allowing remote attack. The exploit is public and may be used.

A vulnerability was found in heshengtao super-agent-party up to 0.4.1, affecting the function sanitize_proxy_url in the file server.py in the extension_proxy Route component. Manipulation of the url argument leads to server-side request forgery. The attack can be initiated remotely, and the exploit has been publicly disclosed.

An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling.

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_internal.c, and toolkit_test_server.

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call, which validates input arguments against runtime-resolved InputArguments metadata.

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, affecting an unknown function in the file /dm/dispatch/user/findAll. Manipulation of the Name argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.