CVE Vulnerability Catalog

PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.

SillyTavern versions 1.12.13 through 1.19.0 contain a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.

Kortix Suna versions 0.10.7 through 0.13.52 contain a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

Strapi versions 5.47.0 through 5.57.0 contain an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data. This issue affects WP Rollback: from n/a through 3.1.2.

Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.

Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.

Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

ZTE Z80 Ultra's system interfaces lack robust invocation authentication and have inadequate access control. Third-party apps may call these interfaces through reflection and retrieve relevant information.

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) from version 2.5.0 to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when hovering over the data point.

In Progress® KendoReact (@progress/kendo-react-charts) from version 1.1.0 to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when hovering over the data point.

The PeproDev Ultimate Profile Solutions plugin for WordPress up to version 8.2.36 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'button' attribute of the 'logout-url' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user accesses an injected page.

The Listdom plugin for WordPress up to version 6.1.2 is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function. Authenticated attackers with administrator-level access can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The Retainful plugin (Email Marketing for WordPress and WooCommerce) is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to and including 1.0.10 due to insufficient input sanitization and output escaping.

The Avada theme for WordPress and WooCommerce is vulnerable to Stored Cross-Site Scripting via user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to and including 7.16.1. These fields are emitted in an anchor href without rejecting dangerous URL schemes such as javascript:.

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via the 'display_name' Profile Field (Second-Order) in all versions up to and including 1.5.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.

The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page; the nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user.

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. Access control for methods within the framework is insufficient, allowing an attacker to read device-related information.