CVE Vulnerability Catalog

A vulnerability in NSD involves a HIP resource record that fills RDATA near its limit and has another dname RDATA field (a HIP Rendezvous server), which can overwrite the stack with up to 191 bytes of attacker-controlled data.

A vulnerability in NSD involves SVCB or HTTPS RRs that fill the wire format RDATA to the brim, where another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker-controlled data of unlimited size.

A vulnerability in NSD involves base64 data split into pieces of 3 characters or less, where tokens are incorrectly calculated to produce 0 bytes, enabling attackers to overwrite the stack with up to 64K of attacker-controlled data.

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can cause a file to be written outside the intended extraction directory.

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy forwards requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. A pipelined second request is relayed verbatim to the backend, bypassing the configured path restrictions.

A heap buffer overflow was found in gst-plugins-base. It can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets exceeding the actual backing memory allocation. The metadata is not range-checked during deserialization, and the frame mapping code does not verify that the declared plane geometry fits within the buffer.

HPE NonStop Middleware software has a secret key handling and data deserialization vulnerability. Technical details were not provided in the description.

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. Technical details were not provided in the description.

The Paid Videochat Turnkey Site (ppv-live-webcams) plugin for WordPress is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions from n/a through 7.5.12.

A vulnerability in curl during upload mishandles HTTP/2 RST_STREAM received from the server, leading to a use-after-free of a struct Curl_easy object.

The LifterLMS plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. The llms_get_template() helper performs extract() on the shortcode attribute array before resolving the template path, allowing attacker-supplied 'template_name' and 'default_path' attributes to overwrite local parameters and control the path passed to a PHP include.

The CP Multi View Event Calendar (cp-multi-view-calendar) plugin for WordPress is vulnerable to SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions from n/a through 1.4.41.

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to and including 2.4.3 due to insufficient input sanitization and output escaping. The save-time sanitizer mbw_htmlspecialchars2() is ineffective because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots.

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to and including 2.5 due to insufficient input sanitization and output escaping. The enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL, and Criteria is never validated against an allow-list. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers, api_keys, and sessions.

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The jobid parameter passed to C4::Scheduler::remove_at_job is not validated, and Schedule::At::remove substitutes it into an atrm command string without quoting or escaping, executing it through a single-argument system() call that invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can execute arbitrary OS commands as the Koha application user.

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 2.4.3 via the '<mode>_type' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, and on standard PHP installations pearcmd.php can be leveraged to write and include an attacker-controlled payload in a single request.

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.17.1 via deserialization of untrusted input. This allows authenticated attackers with administrator-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, so impact only occurs if another plugin or theme with a POP chain is installed.

The ShopMagic – email automation for WordPress plugin is vulnerable to Local File Inclusion in all versions up to and including 4.9.0 via the 'billing_address.first_name' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation requires a published recipe processing the {{ customer.first_name }} placeholder — the built-in "New Order email with social media profile links" recipe satisfies this by default, making the default configuration exploitable with no account, cookie, or nonce.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 5.7.3 via the `booking[id]` and `cart[id]` parameters on the public `steps__reload_booking_form_summary_panel` and `steps__start` routes. The lack of ownership checks allows unauthenticated attackers to enumerate booking and cart identifiers and read other customers' appointment details and pending checkout contents directly from JSON responses.