CVE Vulnerability Catalog

The UiPress lite plugin for WordPress in all versions up to and including 3.5.08 is vulnerable to Sensitive Information Exposure. This is due to missing capability checks in the 'uip_process_block_query' AJAX function. An authenticated attacker with subscriber-level access or above can extract sensitive user data including password hashes, emails, and other information that could be used for account takeover attacks.

Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be executed with the privilege of the user invoking the installer.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_eh_crm_settings_empty_scheduled_actions' AJAX Action in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the scheduled triggers option.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_empty_trash' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to empty the ticket trash.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_restore_data() function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to restore tickets.

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to restore all deleted tickets.

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.

EPSON WebConfig oraz Epson Web Control dla produktów projektorów SEIKO EPSON nie ograniczają nadmiernych prób uwierzytelnienia. Hasło użytkownika administracyjnego może zostać ujawnione w wyniku ataku typu brute force.

The AuthKit library for Next.js in version 2.11.0 and below does not defensively apply anti-caching headers to authenticated responses. In environments with CDN caching enabled, this can result in session tokens being included in cached responses and served to multiple users.

Claude Code, an agentic coding tool, prior to version 2.0.31 has an error in sed command parsing that allows bypassing the read-only validation and writing to arbitrary files on the host system.

W systemie zarządzania plikami itsourcecode Online File Management System w wersji 1.0 odkryto lukę bezpieczeństwa. Problem dotyczy nieznanego przetwarzania pliku /ajax.php?action=login, gdzie manipulacja argumentem Username prowadzi do wstrzykiwania SQL.

Microsoft SharePoint Online has an elevation of privilege vulnerability.

Azure Bastion has an elevation of privilege vulnerability.

The university-bbs (Blogin) system has a weak verification code generation mechanism and lacks rate limiting. This allows an attacker to perform brute-force attacks on verification codes without authentication. Successful exploitation may lead to account takeover via password reset or other authentication bypass methods.

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability due to insecure loading of system libraries. The application does not validate the path or signature of regsvr32.exe it loads. An attacker can place a malicious DLL in the startup directory, which will be executed when the user launches the program.

In FS Inc S3150-8T2F switches before version 2.2.0D Build 135103, authentication credentials (usernames and passwords) are transmitted in cookies as cleartext, only encoded with base64. Every POST request to the administrative interface exposes these credentials in an unencrypted form.

Revive Adserver 6.0.0+ has improper input neutralization, allowing a reflected XSS attack in the banner-zone.php script.

Revive Adserver 5.5.2 and 6.0.1 and earlier versions have improper input neutralization, allowing manager accounts to craft XSS attacks against their own advertiser users.

Debug information disclosure in the SQL error message in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to acquire information about the software, PHP and database versions currently in use.

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts.