CVE Vulnerability Catalog

In bc-csharp before 2.7.0, the CMP/CRMF password-based MAC verifier (PKMacBuilder) does not limit iteration count unless an explicit maximum is provided. A remote attacker can send a CMP message or CRMF request with a very large iteration count, causing CPU exhaustion and denial of service.

In bc-csharp before 2.7.0, IesEngine.DecryptBlock shows an observable discrepancy between padding errors and MAC errors. An attacker who captured an IES/ECIES ciphertext can use a padding-oracle attack to recover plaintext.

In bc-csharp before 2.7.0, the DTLS handshake reassembly allocates memory based on the 24-bit length from the fragment header without checking the maximum handshake message size. A remote attacker can send crafted fragments, causing memory exhaustion and denial of service.

In bc-csharp before 2.7.0, in stream mode of IesEngine, the MAC key is derived directly after a keystream that depends only on the static key pair and fixed parameters. An attacker who knows the plaintext of one message can forge shorter messages that are accepted as authentic.

In bc-csharp before 2.7.0, the DSTU 7624 CCM mode implementation (KCcmBlockCipher) processes the G1 block only when associated data is present. An attacker who observes encrypted messages of known or chosen content can forge ciphertexts with valid authentication tags.

In bc-csharp before 2.7.0, the AES-CCM implementation (CcmParameters and CcmBlockCipher) improperly validates the authentication tag length. An attacker can modify CCM-encrypted content without detection by using an AlgorithmIdentifier with a zero-length or out-of-range tag.

The BA Book Everything plugin for WordPress is vulnerable to stored XSS via the 'booking_service_qty' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts that execute when a user accesses an injected page.

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in versions up to 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path, allowing arbitrary file read, write, or deletion on the server.

The SiteOrigin Widgets Bundle plugin for WordPress (versions up to and including 1.73.2) is vulnerable to Local File Inclusion via the 'theme' parameter. An authenticated attacker with contributor-level access or higher can include and execute arbitrary .php files on the server, leading to PHP code execution. Exploitation requires sending a malicious widgetData payload with a legacy top-level theme key to the /wp-json/sowb/v1/widgets/previews REST endpoint.

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts plugin for WordPress before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request. This allows unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.4) is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) field submission due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.

The Super Forms – Drag & Drop Form Builder plugin for WordPress (versions up to and including 6.3.316) is vulnerable to Privilege Escalation. The Register & Login add-on's before_email_success_msg() function in the register_login_action='update' flow trusts an attacker-supplied user_id value and passes it to wp_update_user() without any ownership or capability check. An authenticated attacker with Subscriber-level access can create a malicious form and submit it with an administrator's user_id and a new password/email, resulting in account takeover.

The CTX Feed Pro plugin for WordPress up to version 7.6.12 is vulnerable to code injection due to insufficient input validation on the 'Feed Config' field, which is passed directly to the eval() function. This allows authenticated attackers with Administrator-level access and above to execute arbitrary PHP code on the server.

The Visitors Traffic Real Time Statistics Pro plugin for WordPress up to version 11.22 is vulnerable to unauthenticated stored Cross-Site Scripting via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is accessible to logged-out users and stores the value without sanitization, which is later rendered in the admin dashboard without escaping, allowing arbitrary JavaScript execution.

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The manipulation of the Title argument in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity results in SQL injection. The attack can be launched remotely, and the exploit is now public.

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. The function fetch_url in mcp_server_fetch/server.py is affected by manipulation of the url/path argument, leading to server-side request forgery. The attack can be initiated remotely, and the exploit has been publicly disclosed. A fix is awaiting acceptance.

The vulnerability involves transmitting a sensitive key in the URL over an unencrypted HTTP connection. The key is sent in plaintext, allowing an attacker monitoring network traffic to intercept it.

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

ClipBucket v5 through 5.5.3-#197 contains an SQL injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can use time-based blind payloads to extract user credentials and emails or modify and delete arbitrary records.