CVE Vulnerability Catalog

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface. Remote attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution.

In Bouncy Castle for Java before 1.86, a vulnerability allows truncated OpenPGP encrypted messages to be accepted without error. On the SEIPD version 1 path, no integrity check is performed at all, and on the AEAD path (SEIPD v2 and v5), the trailing authentication tag is skipped, silently dropping packets after the literal. The issue also affects LTS before 2.73.13 and FIPS (BC-FJA) before specified versions, but only on the AEAD route.

In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate accepted public keys built on a foreign ECC curve that merely shares BLS12-381's field characteristic. This allowed aggregate signatures to verify with a phantom signer, even without a signature for that key and message pair.

In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list failed to verify that the removed leaf actually belonged to the joiner. This missing check allowed any party holding the group's public GroupInfo to send a commit with a Remove proposal naming any member, causing that member to be evicted and their slot in the ratchet tree to be taken over. The fix requires the removed leaf's credential to match the joiner's own new leaf credential on both the sending and receiving side.

In Bouncy Castle for Java before 1.86, both copies of PKIXCertPathReviewer (org.bouncycastle.pkix.jcajce and the legacy org.bouncycastle.x509) failed to apply X.509 name constraints to the end-entity certificate. The checkNameConstraints method walked the path with a loop bound excluding index zero (the target certificate), so the permitted and excluded subtree checks of RFC 5280 sec. 6.1.3 (b) and (c) never ran against the leaf's subject DN or subjectAltName. As a result, a chain whose leaf violated a NameConstraints extension imposed by its issuing CA was reported as valid (isValidCertPath() returned true with an empty error list), while CertPathValidator rejected the identical chain.

In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted messages where digestAlgorithm and authAttrs disagreed about whether authenticated attributes were present. The parser chose based on digestAlgorithm alone, so it could verify the content MAC and then return attributes via getAuthAttrs() as though they had been authenticated, even though the MAC never covered them. This also affects LTS before 2.73.13 and FIPS releases (BC-FJA) before the corresponding bcpkix-fips and bcutil-fips versions.

In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature when that binding omitted a Key Flags subpacket. isSigningKey() inherited SIGN_DATA from the primary key via getKeyFlags() and getApplyingSubpacket(), while verifyEmbeddedPrimaryKeyBinding() read only the binding signature's own hashed subpackets and treated the subkey as non-signing, so the same subkey was both signing-capable and exempt from cross-certification.

In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted third-party certifications or trust delegations from any component key of the issuing certificate, without requiring the component to have certification authority. An attacker could use a restricted subkey (e.g., signing-only or encryption-only) to issue a valid identity certification or trust delegation, which was then attributed to the primary key.

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. When an application passed the same Java array as both input and destination (e.g., encrypting in place over KeyParameter.getKey()), the later mode-0 release wrote the unchanged key bytes over the ciphertext, exposing the raw AES key. The fix releases read-only input arrays with JNI_ABORT, preventing the copy-back.

The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible via guest checkout because the malicious payload is embedded in a multipart Content-Disposition field name starting with 'wpcpo-'.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping and lack of preparation on the SQL query. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database. This is a second-order SQL injection: an attacker submits a crafted referrer URL to the wmcTrack endpoint, which persists the raw value, and the injection triggers when an administrator views the Traffic Sources dashboard.

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 due to improper verification of user permissions. This allows authenticated attackers with contributor-level access and above to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.

The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer includes in its failure error message.

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This allows authenticated attackers with contributor-level access and above to include and execute arbitrary .php files on the server, enabling execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution if .php files can be uploaded and included.

The Smart Manager plugin for WordPress is vulnerable to generic SQL injection via the 'access_privileges' parameter in versions up to and including 8.97.0. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is only possible when an administrator has saved a role-based deny-list configuration that does not block the internal 'access-privilege' module.

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to stored DOM-based cross-site scripting via the 'X-Real-IP' HTTP header in versions up to and including 8.16. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The attack requires no authentication, nonce, or capability.

The Simple Membership plugin for WordPress is vulnerable to unauthorized data modification and sensitive information disclosure in versions up to and including 4.8.3 via the resend-activation and email-activation endpoints. Unauthenticated attackers can redirect a pending member's activation email and the follow-up 'registration complete' email containing username and plaintext password to an attacker-chosen address, and then activate the account without consent.

The Strong Testimonials plugin for WordPress is vulnerable to stored cross-site scripting via the 'platform_user_photo' custom field in versions up to and including 3.3.11. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have added custom text fields 'platform' and 'platform_user_photo' to a public testimonial submission form.

The Transliterator plugin for WordPress is vulnerable to stored cross-site scripting via comment content using a predictable {rstr_keep} placeholder in versions up to and including 2.5.8. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The payload survives WordPress comment sanitization because the tags and attributes used are permitted by the core comment kses allow-list.

The SEOPress plugin for WordPress is vulnerable to stored cross-site scripting via author display name in versions up to and including 10.2. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in Google Analytics 4 or Matomo settings, and the attacker must be able to publish public singular content.