CVE Vulnerability Catalog

The Download Monitor plugin for WordPress up to version 5.1.10 is vulnerable to Cross-Site Request Forgery (CSRF) in the actions_handler() and bulk_actions_handler() functions. Missing nonce verification allows an unauthenticated attacker to delete, disable, or enable approved download paths via a forged request, provided they trick an administrator into clicking a link.

The Gravity Forms plugin for WordPress up to version 2.9.30 has a Stored XSS vulnerability in the Credit Card field's 'Card Type' sub-field. The get_value_entry_detail() method outputs the value without escaping, and get_value_save_entry() accepts unsanitized input. The Card Type field is not rendered on the frontend but the backend accepts it from POST requests. Unauthenticated attackers can inject arbitrary scripts that execute when an admin views the entry in the dashboard.

The Hustle plugin for WordPress up to version 7.8.10.2 has an unauthorized data modification vulnerability due to a missing capability check in the 'hustle_module_converted' AJAX action. Unauthenticated attackers can forge conversion events for any Hustle module, including draft modules.

The Score extension in MediaWiki (The Wikimedia Foundation) is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.

PingIDM (formerly ForgeRock Identity Management) has insufficient granularity of access control for Remote Connector Servers (RCS) in client mode. Attackers can spoof a client-mode RCS to intercept or modify identity security properties such as passwords and account recovery information.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.33 fails to check proper capabilities in multiple AJAX controller actions. Missing checkForCap() and validatePermission() calls allow authenticated attackers with Contributor-level access and above to enumerate slider metadata and create, modify, and delete image storage records.

The GrowthExperiments extension in MediaWiki contains an infinite loop vulnerability that allows leveraging Time-of-Check Time-of-Use (TOCTOU) race conditions. This issue was fixed only on the `master` branch.

The GlobalWatchlist extension in MediaWiki from Wikimedia Foundation is vulnerable to XSS due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

The official Java SDK for Model Context Protocol (MCP) contains a DNS rebinding vulnerability. Prior to version 1.0.0, an attacker can access a local or network-private MCP server via a victim's browser, allowing arbitrary tool calls on the server.

Aardvark-dns versions 1.16.0 to 1.17.0 have a vulnerability where a truncated TCP DNS query followed by a connection reset causes an infinite error loop at 100% CPU usage.

Electron before versions 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5 contains a vulnerability where a child window can be navigated by an unrelated renderer if both use the same target name. This can lead to privilege escalation, and if nodeIntegration is enabled or sandbox disabled, to remote code execution.

LibreChat prior to version 0.8.4 trusts the 'name' field returned by the execute_code sandbox when persisting code-generated artifacts. An attacker can use traversal sequences (e.g., '../../') in the filename, leading to arbitrary file write on the server without validation.

Cronicle before version 0.9.111 has a vulnerability where child processes can modify the parent event's configuration via the update_event key in JSON output without any authorization check. This allows a low-privilege user who can create and run events to change any event property, including webhook URLs and notification emails.

Cronicle, a multi-server task scheduler, prior to version 0.9.111 allows non-admin users to inject arbitrary JavaScript through job output fields. The server stores data without sanitization, and the client renders it via innerHTML on the Job Details page.

xdg-dbus-proxy before version 0.1.7 has a policy parser vulnerability that allows bypassing eavesdrop restrictions. The proxy mishandles cases like 'eavesdrop ='true'' (with a space before the equals sign), enabling clients to intercept D-Bus messages they should not have access to.

Open Source Point of Sale prior to version 3.4.3 has a stored XSS vulnerability in the Daily Sales management table. The customer_name column is rendered as raw HTML, allowing an attacker with customer management permissions to inject JavaScript via first_name or last_name fields.

Stored XSS vulnerability in the Cargo extension for MediaWiki. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code that executes whenever the page is viewed.

XSS vulnerability in the Cargo extension for MediaWiki, targeting non-script elements. Improper input neutralization during page generation allows injection of malicious code.

The Cargo extension for MediaWiki before version 3.8.7 is vulnerable to stored XSS due to improper neutralization of script-related HTML tags. Attackers can inject malicious scripts that execute when a page is viewed.