CVE Vulnerability Catalog

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to 2.1.5.1 due to insufficient sanitization of the 'file' POST parameter on the restoreBackup() AJAX handler. Authenticated attackers with Administrator-level access can execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants.

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the sign_in() and sign_up() AJAX handlers in all versions up to 3.2.7. Authenticated attackers with Subscriber-level access can relink the MailMunch integration to an attacker-controlled account, leading to subscriber data interception.

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.4.16 due to missing or incorrect nonce validation on the process_bulk_action() function. Unauthenticated attackers can delete arbitrary search-term records if they trick an administrator into clicking a link.

In art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, the target file path is resolved via path.resolve(root, filename) with no check afterward that the result remains inside root.

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

Vulnerability in audiobookshelf: authentication exemption check incorrectly matches unauthenticated GET routes, and CacheManager joins decoded values into cache file paths, potentially leading to unauthorized file access.

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

The crop function in the Raster Rust crate clamps crop width/height against source dimensions but only clamps offset_x/offset_y against 0, never against source dimensions, potentially leading to incorrect cropping.

imagecli's pipeline operation only asserts, never validating that the ratio is positive. A negative ratio causes the target width to saturate to 0, which is passed to imageproc::seam_carving::shrink_width, a function that panics when given a width below 2, crashing the process.

The imagecli library's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 1.4.6. The `getCurrentTaskResults()` method is accessible without authentication or authorization checks, allowing unauthenticated attackers to enumerate sequential task IDs and retrieve sensitive configuration data including OpenAI API keys in plaintext.

The WPFormify plugin for WordPress up to version 1.1.1 is vulnerable to unauthorized modification and deletion of Stripe payment credentials. Missing capability checks and nonce verification in the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`, allow unauthenticated attackers to overwrite Stripe API credentials or disconnect the integration entirely.

The LightSync Pro plugin for WordPress up to version 2.1.6 is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_replace_media()` function. Authenticated attackers with Author-level access or above can upload arbitrary files, potentially leading to remote code execution.

The Material Dashboard plugin for WordPress up to version 1.4.10 is vulnerable to unauthorized access and data modification due to missing capability checks in the `amd_ajax_target_task_manager()` function. Unauthenticated attackers can enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the `public_amd_ajax_handler` AJAX action.

The ShopLentor plugin for WordPress up to version 3.3.7 is vulnerable to arbitrary function execution via the `woolentoropt/v1/custom-action` REST API endpoint. The `handle_action()` method passes user-supplied input directly to `call_user_func()` without an allowlist of permitted callbacks. Authenticated attackers with Administrator-level access or above can execute arbitrary PHP callable functions.

A vulnerability in the Linux kernel's xfrm_user_policy() function causes a double-free of sk_dst_cache. The issue occurs when a per-socket policy change for a connected UDP socket races with a send, leading to double release of a reference and use-after-free.

In the Linux kernel, xfrm6_fill_dst() has a double netdev_put issue. On the error path where in6_dev_get(dev) returns NULL, the function releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. Later dst_destroy() calls netdev_put(dst->dev) again, causing double release and refcount underflow, leading to warnings and potential network issues.

In the Linux kernel, the ksmbd (SMB2 server) module has a vulnerability involving an out-of-bounds read (slab-out-of-bounds). During validation of compound (chained) SMB2 requests, ksmbd_smb2_check_message() reads the StructureSize2 field without first checking that the compound element is large enough. A remote client can craft a request whose last element is exactly 64 bytes, causing a 2-byte read past the receive buffer.

In the Linux kernel, gtp1u_send_echo_resp() ignores the return value of skb_pull_data(). When an echo request is 16-19 bytes, the call fails and returns NULL, but execution continues, leading to skb_under_panic() and kernel panic. The fix is to drop the packet when skb_pull_data() fails.

In the Linux kernel, nh_res_bucket_migrate() uses an uninitialized netlink_ext_ack. When notifier initialization fails, the error path formats a pointer to uninitialized memory, potentially leading to a kernel panic.