CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) in Event Tickets versions up to 5.29.4.

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.

Joomla Easy Store extension (versions 1.0.0-3.0.0) lacks CSRF and access control on site configuration update, allowing modification of Joomla mail settings without token verification or admin permissions.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a broken access control vulnerability (ACL bypass) in the allowEdit() method in ApiController.php. This method always returns true, bypassing component-level and asset-level ACL permission checks. Any authenticated backend user can edit any EasyStore record regardless of specific ACL grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) lacks CSRF token verification on most administrator AJAX endpoints. Tokens are only checked in the products() action, while other endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, collections) accept state-changing requests without anti-CSRF tokens. An attacker can trick a logged-in administrator into triggering unauthorized modifications. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has a SQL Injection vulnerability in the coupon bulk update task (couponBulkUpdate). Input IDs are directly concatenated into raw SQL IN (...) clauses without sanitization or parameterization. An authenticated administrator can manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers and using parameterized ->whereIn() queries.

Authenticated, privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0. The media deletion endpoint parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses without integer casting or parameterization.

The Easy Store extension for Joomla (versions 1.0.0-3.0.0) has an unauthenticated PII exposure vulnerability via IDOR in guest checkout. The checkout.searchGuestUser endpoint allows querying guest checkout records solely by supplying an email address. The server returns complete shipping details (full name, phone number, street address, city, postal code, country) from the #__easystore_guests table without authentication, session validation, or ownership checks. An unauthenticated attacker can iterate through email lists to enumerate guest customers and harvest sensitive PII. Resolved by removing the unauthenticated server-side guest lookup endpoint and migrating autofill to client-side localStorage with explicit user consent.

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.

In Red Hat Ansible Automation Platform's automation-controller, four debug views that trigger the internal task, dependency, and workflow schedulers are accessible to any user, including unauthenticated clients, because their URL routing is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endpoints to acquire the cluster-wide scheduler advisory lock, causing real scheduler runs to be skipped and stalling job dispatch for all tenants while consuming controller web workers.

In Brocade SANnav versions before 3.0.1a, insecure access controls on internal service ports allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.

Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices.

In OpenC3 COSMOS from 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials.

In JLine from 3.0.0 until 3.30.15 and 4.3.1, the built-in less viewer passes user-controlled search and display-filter patterns directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool.

In JLine from 3.0.0 until 3.30.15 and 4.3.1, the built-in grep command accepts a user-controlled regular expression and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions.

In OpenC3 COSMOS from 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges.

In CopyAPIView (awx/awx/api/generics.py:873), permission_classes = (IsAuthenticated,) is set, so DRF's get_object() performs no object-level RBAC. The get() handler explicitly guards with request.user.can_access(obj._class_, 'read', obj), but post() does not — it only checks can_access(model, 'add', create_kwargs_check) and can_access(model, 'copy_related', obj). For JobTemplate, can_add and can_copy_related do not imply read permission on the source job template.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/sent-notifications/get-resend-modal-content action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed.

In the Formie plugin for Craft CMS prior to 2.2.23 and 3.1.31, the formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response.