CVE Vulnerability Catalog

Improper authorization vulnerability in SEMCMS (up to 5.0) in /admin/SEMCMS_User.php?Class=Deleted&CF=user. Manipulation leads to improper authorization, remotely exploitable.

Information disclosure vulnerability in WMCMS 4.446.1257 in /index.php. Manipulation of the path/file argument leads to information disclosure, remotely exploitable.

Information disclosure vulnerability in tsi-coop tsi-dpdp-cms versions 0.5.0/0.5.1/0.5.2 in the JSON Schema Validation component. Manipulation of the _func argument leads to information disclosure, remotely exploitable.

The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.

The VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin (up to version 1.2.10) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data they should not be permitted to.

The Paid Videochat Turnkey Site plugin (up to version 7.5.12) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to unexpected application behavior.

The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.

The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin (up to version 2.3.22) contains an Improper Validation of Specified Quantity in Input vulnerability that allows input data manipulation. An attacker may supply invalid quantity values, potentially leading to incorrect price or product quantity calculations.

The TMDS plugin (up to version 1.0.15) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables, so an unauthenticated remote attacker can supply a crafted Remote-User request header which is exposed to the application as HTTP_REMOTE_USER. When HTTP Basic Authentication is configured as the authentication backend, OTRS trusts this value as an already authenticated username and does not perform an additional password verification.

OTRS does not sufficiently neutralize user-controlled values that are later included in CSV exports. An attacker can inject values beginning with spreadsheet formula characters (=, +, -, @), which when the CSV file is opened in spreadsheet software may be interpreted as formulas and perform unintended actions. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and OTRS Community Edition 6.x and earlier.

OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends (e.g., database and LDAP) are configured, the uniqueness check for customer user email addresses is performed only within the selected backend, allowing an authenticated user with permission to create or modify customer users to create a customer user whose email address is already assigned to a customer user in another backend. This can result in customer-related information or email communication being associated with or exposed to the wrong customer user. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X, and OTRS Community Edition 6.x and earlier.

A CSRF vulnerability was identified in OTRS that allows an unauthenticated attacker to force an authenticated administrator's browser to execute administrative actions, such as DBUpdate log cleanup, without proper ChallengeToken validation. The attack can be performed by embedding a crafted GET request in a malicious web page. Successful exploitation can delete existing DBUpdate log entries, reducing the availability of diagnostic and historical information used for troubleshooting and auditing.

In OTRS, previously issued authentication tokens (JWT) are not immediately invalidated when an agent or customer user account is deactivated or its password is changed. A token may remain valid until its regular expiration time, approximately 16 hours. An attacker who previously obtained a valid token can continue to access OTRS with the privileges of the affected account.

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend routes and their associated authorization groups, authentication configuration, enabled product features, third-party integration settings, and other implementation details. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, 2026.X before 2026.7.X.

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory, potentially allowing deletion of files accessible to the OTRS application process.

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This affects OTRS versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X.

An authenticated administrator can be induced to delete administrative Import/Export templates through a CSRF attack. The AdminImportExport::TemplateDelete action does not validate the ChallengeToken, allowing an unauthenticated remote attacker to execute a malicious request with the privileges of an active administrator session. This affects OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X, as well as Community Edition 6.x and earlier.

A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation within the keycloak-services component of Keycloak. Keycloak fails to verify that a client is authorized to use the CIBA flow, allowing public clients to bypass security requirements. An attacker could trick a user into approving a login request, eventually gaining full access to the user's account without needing a client secret.

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. It affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation is possible. The exploit is publicly available and might be used. The vendor was contacted but did not respond.