CVE Vulnerability Catalog

The Customer Email Verification for WooCommerce plugin (versions up to and including 3.3.0) is vulnerable to privilege escalation via the 'alg_wc_ev_verify_email' parameter. The activation code is generated using wp_rand(100), yielding only ~101 possible values, and the verify() handler lacks nonce checks and rate limiting.

The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints due to missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to extract sensitive information from the database.

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist.

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens.

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig to map other users' servers.

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens.

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill.

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe, exhausting file descriptors, memory, and goroutines.

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height, causing writes past the U/V planes.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2. A local attacker can corrupt heap memory via integer wraparound in bitmap size calculation by supplying a crafted v2 persistent cache file with oversized width and height values.

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m). The audio queue buffer size is computed as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU, causing the multiplication to wrap and undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3. A local attacker can corrupt memory by supplying a crafted v3 persistent cache file with large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer.

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu. An unauthenticated attacker can exhaust server memory by completing TLS and streaming bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.

FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes when a user pastes a remote file.

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client. A malicious RDP server can send a non-NUL-terminated window title, causing heap over-reads, title corruption, or client crashes.

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client. A malicious RDP server can request unadvertised camera media types by sending a StartStreamsRequest with oversized dimensions, forcing large allocations and reconfiguring the local camera via the HAL.

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport. A malicious gateway can send zero-length pings, causing a nullptr stream to be passed to websocket_reply_close and crashing the client.

Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52 contains a vulnerability in the session.get_modelmeta.custom_metadata_map function in ultralytics/nn/autobackend.py. Manipulation of the imgsz/names/kpt_shape arguments leads to improper neutralization of directives in dynamically evaluated code, requiring local access.