CVE Vulnerability Catalog

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment. An attacker who knows the account password can bypass the second factor and obtain the user's session, up to administrator.

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it. Any authenticated user such as a subscriber can be granted the WordPress role attached to a paid plan without paying for it.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account. Authenticated users with Author-level access and above can assign themselves an arbitrary role and escalate their privileges to Administrator.

A vulnerability of the HTTP request smuggling type was discovered in HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5. It requires an HTTP/3 frontend (built with QUIC support and a QUIC bind listener) and a backend reached over HTTP/1.1 using chunked transfer coding on a reused connection. When an HTTP/3 request carries no Content-Length header, the declared length from a DATA frame header is credited before the payload is received and emitted verbatim as the HTTP/1.1 chunk size, desynchronizing the connection.

A SQL injection vulnerability was found in Feng Office up to 3.11.13.11, affecting the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php within the Legacy API component. Manipulation of the auth argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The kernel driver idmwfp.sys exposes the \\.\IDMWFP device interface to authenticated local users with an access control descriptor equivalent to D:P(A;;GA;;;AU), and its IOCTL 0x12C028 handler does not authenticate the caller or restrict operations to IDM-owned registry namespaces. This allows a low-privileged local authenticated user to read, create, modify, and delete arbitrary registry values under HKLM and HKU.

In UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7, the webserver does not limit the number of HTTP request headers. A remote attacker can send a request with an unlimited number of headers, causing memory consumption and an unresponsive server, if a websocket or JSON-RPC listener is enabled (disabled by default).

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When api_ssl_verify and upstream_ssl_verify are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client accepts any certificate without chain validation. An attacker positioned to intercept traffic can present a crafted certificate and modify responses, including substituting malicious package content or altering allow/block decisions.

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations, primarily on 32-bit platforms (a "table flip" attack). It does not check the return value of calloc() in wasm_rt_allocate_funcref_table(); when the funcref table allocation fails, table->data remains NULL while table->size keeps the guest-declared element count, enabling arbitrary read/write of host memory and arbitrary code execution. Exploitation requires the allocation to fail, e.g., under an address-space limit, on 32-bit hosts, or under memory pressure.

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host. Flatpak creates app data directories (e.g., /var/cache, /var/data, /var/config, /var/tmp) in every sandbox on every app launch where, in some cases, components of the path are attacker-controlled. Missing symlink protection can redirect the directories, and a malicious symlink can point to arbitrary locations on the host and become mounted inside the sandbox.

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages.

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint, which accepts user-supplied chatflowId and chatId without ownership verification. An attacker can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers.

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.

The GEO my WP plugin for WordPress in all versions up to and including 4.5.5.3 is vulnerable to Local File Inclusion via the gmw_posts_locator_ajax_info_window_loader function. This enables unauthenticated attackers to include and execute arbitrary .php files on the server, allowing execution of any PHP code in those files, bypassing access controls, obtaining sensitive data, or achieving code execution. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion can be leveraged to write and execute arbitrary PHP code, achieving full remote code execution.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.7) is vulnerable to PHP Object Injection via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. The handler lacks capability or role checks, relying solely on a nonce, and passes attacker-supplied values through `esc_sql()`, causing serialized string length mismatches that allow injection of an arbitrary serialized object stream. An authenticated attacker with subscriber-level access or above can achieve remote code execution via the `GuzzleHttp\Cookie\FileCookieJar` POP chain, with an unauthenticated pathway when user registration is enabled.