CVE Vulnerability Catalog

Broken Access Control vulnerability in the MarketKing plugin in versions up to and including 2.1.70. The vulnerability can be exploited by an unauthenticated attacker.

Broken Access Control vulnerability in the WP User Manager plugin in versions up to and including 2.9.19. The vulnerability can be exploited by an unauthenticated attacker.

Cross Site Scripting (XSS) vulnerability in the wpForo Forum plugin in versions up to and including 3.1.5. The vulnerability can be exploited by a user with Subscriber privileges.

The AI Engine plugin in versions up to 3.7.8 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access objects they should not have permission to. The lack of authentication on object references enables manipulation of identifiers to gain unauthorized access.

The PayPlus Payment Gateway plugin in versions up to 8.2.5 contains a Broken Access Control vulnerability that allows an unauthenticated attacker to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for authorized users.

The JetTricks plugin by Jetimpex Inc. (Crocoblock) in versions up to 2.0.1 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to inject a malicious script that is stored and executed in the victim's browser.

The WSP MCP – AI Agents Connector plugin in versions up to 2.7.0 contains a Broken Access Control vulnerability that allows a user with the Contributor role to bypass access control mechanisms. The lack of proper permission verification enables performing operations reserved for higher roles.

The SiteSkite plugin in versions up to 2.1.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows a user with the Contributor role to access objects they should not have permission to. The lack of proper permission verification on object references enables manipulation of identifiers to gain unauthorized access.

Mesop is a Python-based UI framework for building web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.

The Joomla Easy Store extension (joomshaper.com) in versions 1.0.0-3.0.0 contains a Missing CSRF Token Verification vulnerability in the product review submission endpoint (index.php?option=com_easystore&task=product.addReview). The endpoint accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.

The JLine Java console library has a vulnerability in the built-in nano editor where regex search mode passes a user-controlled term to the regex engine without timeout or backtracking bound. A malicious expression can cause excessive CPU usage and block the editor session thread.

The JLine library has a vulnerability in DefaultHistory.matchPatterns where the HISTORY_IGNORE configuration value is converted to a regex with incomplete escaping. An attacker controlling configuration can supply a malicious expression that is reevaluated on each history addition, causing excessive CPU usage and blocking the reader thread.

The StringListPathField.to_internal_value() method calls os.path.exists() on unbounded user-supplied paths. The 200 vs 400 response difference reveals the existence of arbitrary absolute paths on the controller-web pod, including sensitive files like SECRET_KEY or service account tokens.

The HostList.list() method catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user can trigger Django FieldError (leaking the complete Host model relation graph) or PostgreSQL DataError (leaking raw database error strings).

The /api/v2/config/ endpoint is protected only by IsAuthenticated, meaning any authenticated user receives license_info, including account numbers, subscription IDs, pool_id, SKU, support level, and instance counts. The superuser/auditor gate only covers other fields, not license_info.

The JobJobEventsChildrenSummary view has no model or parent_model, causing ModelAccessPermission.check_get_permissions() to return True for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check, allowing a zero-privilege user to read event tree structure and enumerate Job IDs platform-wide.

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. The differential "Not found." vs "No <Model> matches..." reveals whether a named resource exists on the platform.