CVE Vulnerability Catalog

The Uncanny Automator plugin for WordPress up to version 7.3.1.4 is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function. Unauthenticated attackers can delete critical files like wp-config.php, potentially leading to remote code execution. Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone'.

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.8.5. Missing nonce validation in the execTemplate function allows unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, bypassing path validation and leading to code execution.

The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function, allowing authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, provided the site administrator has configured the built-in DIGITS User Role field.

The FunnelKit WordPress plugin before version 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.

The Abandoned Cart Lite for WooCommerce WordPress plugin before version 6.8.2 does not protect the integrity of its cart-recovery tokens or bind them to the requesting account. This allows unauthenticated attackers to forge a recovery link that logs them in as another user when the automatic-login option is enabled.

The Redux Framework WordPress plugin before version 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields. This allows users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled.

In the Linux kernel, in __ip_append_data() for IPv4, there is an error in alloclen and pagedlen calculations on the paged allocation path, leading to undersized linear area and oversized pagedlen. This may cause packet handling errors.

The RPB Chessboard plugin for WordPress up to version 8.1.2 is vulnerable to Stored Cross-Site Scripting via Comment Content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when users access affected pages.

A vulnerability in Loki allows queries with large limits to cause significant memory allocations, potentially impacting service availability depending on the deployment strategy.

The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress up to version 1.4.4 is vulnerable to generic SQL injection via the 's' and 'match' parameters. Insufficient escaping and lack of proper SQL query preparation allow unauthenticated attackers to append additional SQL queries, potentially leading to sensitive data extraction from the database.

A stack-based buffer overflow vulnerability was found in the libsolv library within the PGP verification component. The flaw is caused by incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker can craft a malicious Ed25519 PGP signature with mismatched MPI lengths, leading to denial of service in automated package or repository processing workflows.

A flaw was found in QEMU allowing a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects.

A vulnerability in the `/ws/chat` endpoint of the Feast Feature Server allows remote attackers to establish persistent WebSocket connections without authentication. Opening a large number of simultaneous connections can exhaust server resources such as memory, CPU, and file descriptors, leading to a complete denial of service for legitimate users.

A flaw in Keycloak's JWT authorization grant preview feature fails to validate disabled user accounts during JWT processing, allowing an attacker to obtain a token for a disabled user.

A SQL injection vulnerability has been found in H3C SecPath F1000-C8300 up to version 20260522 in the file /webui/?g=log_fw_nbc_mail_jsondata. The attack involves manipulating the subject argument and can be executed remotely. The vendor confirmed the flaw and plans to release a fix.

The vulnerability in PlaywrightCapture stores capture-specific configuration and runtime data as mutable class-level variables instead of instance-level variables. This causes multiple Capture objects in the same Python process to share state, including HTTP headers, cookies, credentials, and captured request data.

A vulnerability in MaaAssistantArknights allows an attacker to execute arbitrary shell commands on a GitHub Actions runner by injecting code into the pull request title. The issue occurs in the dev-v2 workflow where the PR title is directly used in a shell command during pull_request opened, reopened, and ready_for_review events.

In Wekan prior to version 9.37, DDP update rules in cards.js, lists.js, and swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. An authenticated user with write access to their own board can move cards, lists, or swimlanes into a private board they are not a member of.

In Wekan prior to version 9.32, the copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules.

In Wekan prior to version 9.32, OIDC-related Meteor methods are globally callable without admin authorization checks. Authenticated users can create or modify organizations and teams, and grant global admin privileges when PROPAGATE_OIDC_DATA is enabled.