CVE Vulnerability Catalog

MyBB before version 1.8.40 in the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses, and verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result for IPv6, allowing a crafted remote target to bypass the host restriction.

MyBB before version 1.8.40 in the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar.

Prior to version 1.8.40, the calendar module in MyBB does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the calendar module in MyBB does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.

Prior to version 1.8.40, the Admin CP UTF-8 Conversion module in MyBB does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. This issue is fixed in version 1.8.40.

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email.

A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.

Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.

Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions.

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

The Gravity Booster – Styles & Layouts for Gravity Forms plugin version 6.0 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

The RomethemeForm For Elementor plugin version 1.2.6 and earlier has a broken access control vulnerability exploitable by Contributor users. This means a contributor can gain unauthorized access to functions they should not have permissions for.

The User Registration plugin version 5.2.6 and earlier has a broken authentication vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to accounts or functions they should not have permissions for.

Trix, a what-you-see-is-what-you-get rich text editor, prior to version 2.1.17 is vulnerable to cross-site scripting via a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML with this attribute containing a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session, potentially leading to unauthorized actions or disclosure of sensitive information.

The MasterStudy LMS plugin version 3.7.41 and earlier has a broken access control vulnerability exploitable by Subscriber users. This means a subscriber can gain unauthorized access to functions they should not have permissions for.

The Flutterwave WooCommerce plugin version 3.3.0 and earlier has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.

The Piraeus Bank WooCommerce Payment Gateway plugin version 3.2.0 has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.

The Booking calendar, Appointment Booking System plugin version 3.2.36 and earlier has an insecure direct object references (IDOR) vulnerability that does not require authentication. This means an unauthenticated attacker can access objects (e.g., bookings) without authorization.

The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.