CVE Vulnerability Catalog

A vulnerability was determined in ag2ai ag2 up to 0.13.4, affecting the os.path.join function of the UserProxyAgent component. Manipulation of the filename argument causes path traversal. The attack can be carried out remotely and the exploit has been publicly disclosed.

A vulnerability was found in 021is elvix-sdk up to 0.10.1, affecting an unknown functionality of src/mcp/index.ts of the MCP Request Handler component. Manipulation of the path argument results in server-side request forgery. The attack can be executed remotely and the exploit is publicly available.

The WP-Invoice WordPress plugin through version 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names, and profile details of all registered users.

The MemberHero WordPress plugin through version 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

The Veeqo for WooCommerce WordPress plugin through version 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the plugin download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.

The paymendo WordPress plugin through version 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

The paymendo WordPress plugin through version 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.

The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.

The Robo Gallery WordPress plugin before version 5.2.6 does not sanitize and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.

The Post Snippets WordPress plugin through version 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

A vulnerability was found in highwarden Super Store Finder up to version 3.8. An unknown function in /products/superstorefinder/index.php is affected, and manipulation of the lat/lng arguments leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed. Upgrading to version 3.9 addresses the issue.

A vulnerability was detected in GPAC up to 26.07.0 affecting the function gf_fq_pop of the file filter_core/filter_queue.c of the MP4Box component. Manipulation results in use after free, and the attack may be initiated remotely. The exploit is now public and may be used; the vendor was contacted early but did not respond.

A security vulnerability has been detected in GPAC up to 26.07.0 affecting the function gf_mx_v of the file utils/os_thread.c of the MP4Box component. Manipulation leads to use after free, and the attack can be launched remotely. The exploit has been disclosed publicly and may be used; the vendor was contacted early but did not respond.

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1 affecting unknown code of the file outboundTarget.ts of the git-sources Browse API Endpoint component. Manipulation of the repo_url argument can lead to server-side request forgery, and the attack may be performed remotely. The exploit has been publicly disclosed and may be utilized; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1 affecting the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the Add Remote Node API Endpoint component. Manipulation leads to server-side request forgery, and the attack can be executed remotely. The exploit has been disclosed to the public and may be used; the vendor confirms that the node API URL could be configured by an authenticated user with node-management permission.

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/{id} to collect URLs of all uploaded objects, exposing file contents on publicly readable buckets.

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.