CVE Vulnerability Catalog

A vulnerability in Proliz OBS allows insertion of sensitive information into sent data, enabling access to functionality not properly constrained by ACLs. The issue affects versions prior to 3.6.0.

A SQL injection vulnerability was found in the Hospital Bed Management System 1.0 login form. An attacker can remotely manipulate the username field, leading to SQL injection. The exploit has been published and could be used.

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The default user agent is initialized with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be logged in to the Dancer application as any Google user.

A vulnerability in the ZenHive mpp library allows an unauthenticated remote attacker to drain the fee-payer wallet in a single request by specifying an arbitrarily high gas price. The library does not validate the max_fee_per_gas and max_priority_fee_per_gas fields before co-signing the transaction, causing the server's wallet to be charged inflated costs.

A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to inflate the fee-payer's gas cost by adding a large number of fabricated EIP-2930 access list entries. The server co-signs the transaction without validating the list length or contents, leading to a multiple increase in gas costs.

A vulnerability in the mpp library (ZenHive) allows an unauthenticated remote client to drain the fee-payer wallet by submitting EVM transactions with a deliberately low gas limit. The server co-signs and broadcasts the transaction, which fails due to out-of-gas, but the fee-payer wallet is charged for the burned gas while the attacker pays nothing. This leads to denial of service for legitimate clients as the fee-payer wallet runs out of funds.

Improper access control in the Hashtopolis server web-interface chunk activity component before version 0.14.8 allows any created account to read all cracked hashes of a Hashtopolis server instance.

The User Registration & Membership WordPress plugin before version 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form. This allows unauthenticated users to register into an arbitrary published membership tier and obtain its associated role, including administrator if such a tier exists.

The PhonePe Payment Solutions WordPress plugin before version 3.1.0 does not properly verify the authenticity of incoming payment callbacks. The secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.

The ASUS AURA SYNC driver exposes an IOCTL with insufficient access control, allowing a local user to bypass driver verification and invoke arbitrary IOCTLs, resulting in privilege escalation. This vulnerability is unsupported (UNSUPPORTED WHEN ASSIGNED).

The LearnPress WordPress LMS plugin up to version 4.4.1 is vulnerable to sensitive information exposure via the check_answer function. Unauthenticated attackers can extract correct answer markers, full option lists, explanations, and question content for any quiz question, including those from paid courses the attacker is not enrolled in.

The ProfilePress plugin for WordPress up to version 4.16.18 is vulnerable to arbitrary file upload. The allowed_mime_types function globally adds executable extensions (.exe, .apk, .msi) to the MIME allowlist without scoping to digital product contexts. This allows authenticated attackers with author-level access or above to upload executable files, leading to remote code execution.

The Kali Forms plugin for WordPress (versions up to 2.4.18) is vulnerable to stored XSS via the 'digitalSignature' field. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when users access the affected page.

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather than via cookies), an attacker who obtains a valid access token (e.g., via log leakage, Referer headers, browser history, or network capture) can issue fully authenticated cross-origin requests from any malicious website to read sensitive data and perform write operations as the token's user.

Vulnerability in Grav API plugin before version 1.0.0-rc.16. JWT tokens are accepted via the ?token= URL parameter, causing them to be logged in server logs, leaked via Referer header, stored in browser history, and captured in proxy/CDN logs. A leaked token enables unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

OpenRemote before version 1.26.0 contains an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint. The vulnerability is caused by concatenating asset display names directly into PostgreSQL queries, allowing an attacker with asset creation or rename permissions to inject malicious SQL.

Vulnerability in Grav before version 2.0.4: unrestricted cURL protocols in webhooks. Authenticated users with api.webhooks.write permission can create webhooks with file://, dict://, or gopher:// URLs.

The Grav API plugin before version 1.0.6 fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

Grav before version 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen value, compute a valid TOTP code, and complete authentication while reducing 2FA to password-only protection.

The Grav API plugin (getgrav/grav-plugin-api) before version 1.0.6 contains an authorization bypass. API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes, returning the full user account object. This means a key with limited scopes (e.g., read-only) can perform any write, delete, or administrative operation the owning user is authorized for.