CVE Vulnerability Catalog

REDAXO prior to 5.21.2 in the mediaIsInUse() handler in media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when deleting media referenced by the type's effects.

REDAXO prior to 5.21.2 in rex_api_install_package_update in api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site.

REDAXO prior to 5.21.2 in rex_list::getSortColumn() in list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password.

The scim-patch library before version 0.9.2 has a vulnerability where navigate() and assign() improperly handle inherited properties when processing SCIM PATCH paths. An attacker can exploit properties like toString to mutate global process objects, affecting application logic.

Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 contains an improper privilege management vulnerability. A low-privileged attacker with remote access could gain unauthorized access.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.

The SUMIT Payment Gateway for WooCommerce before version 4.0.0 does not verify that payment notifications from the payment provider are genuine before marking orders as paid. This allows unauthenticated users to mark pending orders as paid without completing payment.

Server-Side Request Forgery (SSRF) vulnerability in Weoll before version 3.2.45.44 allows an attacker to send requests from the server to internal resources.

Vulnerability in Keycloak's Pushed Authorization Request (PAR) implementation. When silent authentication (prompt=none) is used, the authorization process skips certain steps, failing to enforce that a pushed request URI is used only once. An attacker can reuse the URI to obtain multiple authorization codes for a logged-in user, violating security standards like FAPI-2.

Vulnerability in Keycloak's Conditional OTP authenticator. The system evaluates specific HTTP headers to decide whether to skip OTP but does not verify if those headers are from a trusted source. An attacker with the user's password can bypass second-factor authentication by providing a crafted header.

Open redirect vulnerability in AVESİS by Abis Technology allows input data manipulation, potentially redirecting users to untrusted sites.

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100.

The Reachy Mini Bluetooth service asks for a PIN before accepting commands, but the authenticated state is shared across all devices, allowing an attacker in Bluetooth range to ride on someone else's successful authentication without knowing the PIN.

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, nor does it exclude keys reserved by WordPress. Unauthenticated visitors submitting a public form that collects post content can attach arbitrary metadata to the post their submission creates.

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.

The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.