CVE Vulnerability Catalog

A Server-Side Request Forgery (SSRF) vulnerability was found in the Apache Camel A2A component. WebhookUrlValidator classified webhook hosts inconsistently: IPv6 addresses in the fc00::/7 range were rejected when written as literals but accepted when resolved from a hostname, allowing an attacker to make the Camel process send a request to an internal address. The validator also wrongly rejected hostnames beginning with fc or fd, such as fcm.googleapis.com.

The Product Import Export for WooCommerce plugin in versions 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.

OmniRoute versions 3.8.0 before 3.8.52 contain an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

The myCred plugin contains an authentication bypass by spoofing vulnerability that allows identity spoofing. The issue affects versions from n/a through 4.0.1.

The Everest Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.

The Everest Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence of the vulnerability exploitation in-the-wild.

The JoomSport plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.

The HT Mega Addons for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' attribute of <a> inside .htmega-tab-nav in all versions up to and including 3.2.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled, an HT Mega Tabs widget on the same page as the comment section, and a victim clicking the injected anchor link.

The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description' XML element in imported feeds in all versions up to and including 5.2.12 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import.

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to and including 7.9.1 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to enable Viewport Images (VPI) and configure a VPI filename matching an image the attacker can embed in user-generated content.

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to and including 13.2.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts.

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to and including 13.2.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured.

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to and including 3.6.5 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to and including 3.42 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. Exploitation requires a publicly accessible page with an [mla_gallery] shortcode configured with pagination output mode and an mla_link_href template reflecting a {+request:...+} token, along with enough attachments to trigger pagination.

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to and including 5.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires a site administrator to have previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is controlled by the attacker.

A cross-site scripting (XSS) vulnerability exists in the ICTBroadcast software, affecting the demo environment. The 'editForm[extension_username]' parameter in the 'login.php' endpoint is reflected in the response without proper filtering, allowing an attacker to execute arbitrary JavaScript in the victim's browser when the victim visits a malicious URL.

In the HOTP authentication mechanism of keycloak-services, the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a user's password can exploit this timing gap to use a single one-time code to log in multiple times simultaneously.

In the Pushed Authorization Request (PAR) implementation of keycloak-services, restarting an authentication flow incorrectly clears the internal markers tracking PAR consumption while leaving the request active. An attacker can reuse the same authorization request to obtain multiple access tokens, bypassing single-use requirements.