CVE Vulnerability Catalog

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, and enumerate users through discrepant errors.

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or hijack their session.

A SQL injection vulnerability was detected in RainyGao DocSys up to 2.02.85 in the BaseController.createDBForMysql function of BaseController.java (Database Management component). Manipulation of the url argument allows SQL injection. The exploit is publicly available and the attack can be executed remotely.

A security flaw was discovered in mooSocial up to 3.2.4 involving SQL injection via manipulation of the rating argument in /stores/all-products. The attack can be initiated remotely and the exploit has been publicly released. The vendor was contacted but did not respond.

A server-side request forgery (SSRF) vulnerability was identified in SciPhi-AI R2R up to 3.6.6 in py/shared/abstractions/llm.py (Retrieval Completion API Endpoint component). Manipulation of the generation_config.api_base argument leads to SSRF. The exploit is publicly available and the attack can be launched remotely.

A hard-coded credentials vulnerability was determined in SciPhi-AI R2R up to 3.6.6 in the JWT Secret Handler component. Manipulation of DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely and the exploit is publicly disclosed.

The Cost Calculator Builder plugin up to version 4.0.17 contains a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.

The WP Statistics plugin up to version 14.16.14 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Gutenberg Blocks by Kadence Blocks plugin up to version 3.7.11.1 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.

The Unlimited Elements For Elementor plugin up to version 2.0.20 contains a reflected XSS vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The TranslatePress plugin up to version 3.3.6 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, disabling WordPress core's REST nonce protection for every route. This allows an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path].

Authorization bypass through user-controlled key vulnerability in Ultimate Member up to version 2.13.1. Allows privilege escalation.

Reflected XSS vulnerability in Unlimited Elements For Elementor up to version 2.0.20. Improper input neutralization during web page generation.

Improper validation of specified quantity in input in Kirki up to version 6.3.1. Allows accessing functionality not properly constrained by ACLs.