CVE Vulnerability Catalog

A cross-site scripting (XSS) vulnerability exists in the ICTBroadcast software, affecting the demo environment. The 'editForm[extension_username]' parameter in the 'login.php' endpoint is reflected in the response without proper filtering, allowing an attacker to execute arbitrary JavaScript in the victim's browser when the victim visits a malicious URL.

In the HOTP authentication mechanism of keycloak-services, the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a user's password can exploit this timing gap to use a single one-time code to log in multiple times simultaneously.

In the Pushed Authorization Request (PAR) implementation of keycloak-services, restarting an authentication flow incorrectly clears the internal markers tracking PAR consumption while leaving the request active. An attacker can reuse the same authorization request to obtain multiple access tokens, bypassing single-use requirements.

In the client registration component of Keycloak, when a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to reveal secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text.

In the JWT Authorization Grant implementation of keycloak-services, when an OIDC or Google identity provider is configured with login restrictions such as claim filtering, these checks are applied during standard browser logins but skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

A NULL pointer dereference flaw in 389-ds-base occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with ModifyDN permission on the affected entry can crash the directory server.

The Password Protected plugin for WordPress is vulnerable to stored cross-site scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Once the Freemius opt-in is complete, the handler processes the 'purchased_plan' request parameter on any wp-admin request from an authenticated user without capability, nonce, or purchase validation, and stores it in a persistent site-wide administrative notice.

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation. This allows unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it. This allows unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission. This allows unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks, allowing an authenticated low-privileged user such as the Monitor role to view sensitive system properties and JVM configuration details that should be restricted.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records. This allows unauthenticated attackers to delete arbitrary statistics entries.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics. This allows attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings. This allows an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the plugin's contact-form notifications through infrastructure the attacker controls.

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.