CVE Vulnerability Catalog

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests. This allows unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.

The User Frontend WordPress plugin before version 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in SQL injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in SQL injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin is vulnerable to Stored DOM-Based Cross-Site Scripting via the post_content parameter (data-label DOM sink) in all versions up to and including 1.3.4 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits an injected page. Exploitation requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode.

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing and has the potential to achieve memory corruption.

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service.

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires the attacker to be able to run arbitrary code on a node, either by achieving remote code execution via another vulnerability or by having administrative access to the operating system.

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node.

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service.

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a WebRTC/API client.

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible.

Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service.

Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service.

A SQL injection vulnerability was identified in SourceCodester Online Reviewer Management System 1.0, specifically in the file /reviewer_0/admins/assessments/examproper/btn_functions.php. Manipulation of the access_code argument allows SQL injection. The attack can be performed remotely and a public exploit is already available.

A SQL injection vulnerability was found in SourceCodester Online Reviewer Management System 1.0, in the file /reviewer_0/admins/assessments/examproper/questions-view.php. Manipulation of the ID argument allows SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

An OS command injection vulnerability was identified in HKUDS AnyTool 0.1.0, in the subprocess.run function of anytool/local_server/main.py (Execute Endpoint component). Manipulation of the command/shell argument allows OS command injection. The attack can be initiated remotely and the exploit is publicly available.

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded traversal such as %2e%2e/ bypasses both the view-resolver check and the loader-side containment, reading files outside the configured template base directory.