CVE Vulnerability Catalog

AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. An attacker can supply a crafted .ksm module whose notes share one time slot, causing memory corruption and denial of service.

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. An attacker able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

The WP E-Signature Ninja Forms Signature Contract Add-On plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 3.2.5.

The WP Chill Download Monitor plugin contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 5.3.3.

The WordPress plugin 'Login with phone number' (versions up to 1.8.77) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WooCommerce plugin 'Flexible Quantity – Measurement Price Calculator' (versions up to 2.3.23) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WordPress plugin 'PlanetStudio Payment Gateway' (versions up to 1.3.3) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Infinite Uploads' (versions up to 3.4.1) has an insertion of sensitive information into sent data vulnerability, allowing retrieval of embedded sensitive data.

The WordPress plugin 'Ajax Search Lite' (versions up to 4.14.5) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The undici library (versions 5.15.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its WebSocket client that allows a malicious server to exhaust process memory by sending PING frames without reading PONG responses, causing unbounded growth of the outbound write queue and heap.

The undici library (versions 6.5.0-6.29.0, 7.0.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its EventSource client that allows a malicious server to exhaust process memory by sending millions of tiny completed data fields without a blank event separator, or a single unfinished line split across many chunks, causing unbounded parser state accumulation beyond byte limits.

The WordPress plugin 'Strong Testimonials' (versions up to 3.3.12) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WordPress plugin 'Presto Player' (versions up to 4.5.3) has a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

undici, an HTTP client library for Node.js, in versions 6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1 crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects the response due to a content-encoding limit, but the internal response stream was created before that check without an error listener or request abort, so the early close surfaces an unhandled error and terminates the process.

The undici library (versions 7.15.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its fetch() implementation that verifies Subresource Integrity (SRI) metadata by matching the algorithm token against a lowercase-only set, so a valid but non-lowercase token (e.g., uppercase SHA256) is treated as unknown and skipped, causing the response to be accepted without integrity check.

undici in versions 7.0.0-7.30.0 and 8.0.0-8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, builds the cache key from the original request URL before the redirect handler changes the origin. A response produced after a cross-origin redirect is stored under the original key, allowing persistent cache poisoning and disclosure of private data to a later unauthenticated caller.

The Sunshine Photo Cart plugin for WordPress (up to version 3.7.4) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user can access functionality that should be protected.

undici in versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1 passes Agent constructor options through a JSON-based deep clone before forwarding them to each per-origin pool. Because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped, so a TLS peer whose certificate the custom callback was written to reject but which passes Node's default checks is silently accepted.

In the Ansible Automation Platform UI (Hub module, DocumentationParsers.tsx), documentation links are rendered without restricting the URL protocol/scheme. A collection with a link using a script-executing scheme can cause script execution in the browser of another authenticated user who clicks it — a stored XSS issue.

The Knowledge Base plugin by WebberZone (up to version 3.2.0) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can access protected functionality.