CVE Vulnerability Catalog

Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the PublishPress Authors plugin allows Stored XSS. This issue affects PublishPress Authors through version 4.17.0.

Missing Authorization in the Brainstorm Force SureDash plugin allows exploitation of incorrectly configured access control security levels. This issue affects SureDash through version 1.12.3.

Missing Authorization in the WP Desk Custom Price for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Custom Price for WooCommerce through version 1.1.29.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the WP Chill Strong Testimonials plugin allows Stored XSS. This issue affects Strong Testimonials through version 3.3.15.

Missing Authorization in the Magepeople inc. Taxi Booking Manager for WooCommerce plugin allows exploitation of incorrectly configured access control security levels. This issue affects Taxi Booking Manager for WooCommerce through version 2.1.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Brainstorm Force SureDash plugin allows Stored XSS. This issue affects SureDash through version 1.12.3.

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allow unauthorized attackers to arbitrarily read another user's private notes, tasks, and diary content.

A flaw was found in dnsmasq: when DHCP leasequery is enabled without an allowed source address list, the server does not verify who sent the query. A host on the local network can query DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator enables it.

In dnsmasq, the DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

The Codection Import and export users and customers plugin contains a Stored Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. The issue affects versions from the initial release through 2.5.9.

The Brave Popup Builder WordPress plugin (Brave) through version 0.8.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The PDF Poster WordPress plugin (pdf-poster) through version 2.6.1 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious script can be persistently stored and executed for users.

The HivePress Claim Listings plugin through version 1.1.4 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

The Kali Forms plugin through version 2.4.27 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control levels. This may permit unauthorized operations.

The User Registration plugin (ThemeGrill) through version 5.3.0 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This allows code injection into the page.

The Multiple Pages Generator plugin (Themeisle) before version 4.2.5 contains a stored XSS vulnerability that allows Contributor-level users to inject script via the base-url attribute of the [mpg] and [mpg_match] shortcodes. Malicious payloads pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}.

lwIP versions 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() where copies are bounded by pbuf->len instead of remaining bytes. A remote unauthenticated attacker knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or pool memory echoed in responses.

The flat library through version 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Keys such as a.4294967294 can block the Node.js event loop during iteration with forEach, spread, or JSON.stringify.

JeeSite versions 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. An attacker knowing a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.