CVE Vulnerability Catalog

The 多说社会化评论框 plugin for WordPress up to version 1.2 contains a privilege escalation vulnerability. Missing capability and nonce checks on a web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature, allow unauthenticated attackers to update arbitrary WordPress options. Attackers can set the default role to administrator, enable registration, and then register an account with full admin privileges.

The Jssor Slider plugin for WordPress up to version 3.1.24 is vulnerable to Directory Traversal via the 'url' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information.

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers with subscriber-level access and above to execute code on the server.

In OpenSSH before version 10.4, a use-after-free vulnerability exists in the SSH client during key re-exchange when a server changes its host key. This issue affects only the client side.

In Coder from version 2.30.0 to 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true`, accepting any TLS certificate for outbound HTTPS to the Coder access URL. This allows man-in-the-middle attacks.

A vulnerability in Coder CLI allows session token theft by opening a malicious workspace app URL. An attacker (template author) can configure an external workspace app that, when `coder open app` is executed, substitutes the session token in the URL and opens it in the victim's browser.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app entry and `insertAgentApp` accepts the app ID from the `CompleteJob` payload without verifying it belongs to the workspace being built. This allows cross-workspace agent reassignment, requiring elevated privileges of a template author or external provisioner operator.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator does not validate the AllowedIPs field supplied by agents, allowing an agent to spoof another UUID and intercept network traffic. This vulnerability lets unauthorized agents inject arbitrary routes into WireGuard peer configurations, potentially enabling man-in-the-middle attacks.

A vulnerability in Coder allows injection of arbitrary SSH configuration into the user's ~/.ssh/config via unsanitized HostnameSuffix and SSHConfigOptions values supplied by the server. Exploitation requires control over the Coder server (malicious deployment, MITM attack, or admin access).

The GET /api/video/ai endpoint in Cap fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint only authorized `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password.

In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the OIDC callback validation of `email_verified` was vulnerable due to a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (e.g., string "false") or omitted it, the assertion failed open, treating the email as verified. Combined with an unconditional email-based account fallback, this enabled account takeover.

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and GetAccessTokenComponent.java components.

A vulnerability in the String::Util library for Perl before version 1.36 allows a Regular Expression Denial of Service (ReDoS) attack. The trim and rtrim functions use the regular expression s/\s*$//u, which causes quadratic backtracking on long whitespace strings, leading to CPU exhaustion.

Vulnerability in DBI for Perl before version 1.650 allows code injection via the Profile attribute, which is interpolated in eval without validation. An attacker can control Profile through the DBI_PROFILE environment variable, direct assignment, or DSN clause, leading to arbitrary Perl code execution.

In FastGPT prior to v4.15.0-beta5, two file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint.

Koodo Reader version 2.3.0 and earlier is vulnerable to remote code execution via malicious EPUB files. The vulnerability is due to nodeIntegrationInSubFrames being enabled in the open-book IPC handler and EPUB chapter content being rendered with unsanitized innerHTML. An attacker can craft an EPUB that, when imported and opened, creates a hidden iframe with Node.js API access and executes arbitrary OS commands with the victim's privileges.

In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in the OIDC login mechanism chain into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject, and the `email_verified` claim was only enforced when present as a boolean `false`, so an absent or non-boolean claim was treated as verified.

In FastGPT prior to version 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata.

In FastGPT before version 4.15.0, the GET /api/core/ai/record/getRecord endpoint authenticates the caller but loads LLM request and response traces only by requestId without team scoping. This allows any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known.