CVE Vulnerability Catalog

Unauthenticated Denial of Service attack in Two Factor versions up to 0.16.0. An attacker can cause service unavailability without authentication.

Vulnerability in Cato Windows SDP Client before version 6.12.6 allows arbitrary file disclosure. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate enforcement.

SQL injection vulnerability in OS4ED openSIS-Classic up to 9.3. The function DBQuery_assignment in file modules/grades/Assignments.php (component Assignment Management Endpoint) allows manipulation of the argument Tables, enabling remote attack. Exploit is publicly available.

The WPMobile.App (wpappninja) plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 11.83. This allows retrieving embedded sensitive data.

In Grafana, a user with the Editor role can set file-provisioning metadata (grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

In Grafana, an authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

In OS4ED openSIS-Classic up to version 9.3, the save action function in modules/students/Student.php (General Information Tab component) is vulnerable to SQL injection via manipulation of the students argument. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed but has not responded.

In Apache MINA SSHD versions 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-sftp component in the SFTP v6 check-file-name/check-file-handle extension is vulnerable to server-side memory exhaustion. Using a very small block size (e.g., 256) on a huge file generates many hashes, and the SFTP reply is accumulated in memory, potentially crashing the server.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the ssd-scp component is vulnerable to uncontrolled resource consumption. The SCP protocol is line-oriented, and the handler did not impose a limit on line length. A malicious peer sending an endless sequence of characters without LF can cause memory allocation and application crash due to OutOfMemoryError.

In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, the sshd-git component has improper input validation. The fix for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command. Authenticated SSH clients can remotely execute git commands, including writing archives on the server.

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to and including 7.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is further enabled by the absence of capability, nonce, or ownership checks on the wp_ajax_rem_create_pro_ajax handler, and because the value is persisted via update_post_meta, the wp_kses filtering does not apply.

The ReactPress – Create React App for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to and including 3.4.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body is written verbatim to disk via file_put_contents().

In Moodle, the XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. An attacker can trick an authenticated user with grade management permissions into visiting a malicious webpage, triggering unauthorized requests on the victim's behalf. This allows a remote attacker to set or overwrite student grades without authorization.

In Moodle, insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (XSS) attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary script in the victim's browser.

In Moodle, when enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.

In Moodle, due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores.

In Moodle, insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious content into a forum post, which then executes arbitrary script code in the browser of another user viewing the affected post.

In Moodle, an incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

In Moodle, an authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

In Moodle, incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).