CVE Vulnerability Catalog

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

The Master Slider WordPress plugin through 3.11.2 does not sanitize and escape some shortcode attributes before outputting them in an inline script context, allowing users with Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed.

A flaw has been found in SxDevOps versions 1.0 and 1.1 in the subprocess.Popen function of the file backend/aiops/services.py (MCP STDIO Server Management component). Manipulation of the endpoint_or_command argument causes command injection, and the attack may be initiated remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A vulnerability was detected in NginxProxyManager (nginx-proxy-manager) up to version 2.15.1 in the internalCertificate.validate function of the file backend/internal/certificate.js (Validate Route component). Manipulation results in missing authentication, and the attack can be launched remotely. The exploit is now public and may be used; the endpoint only processes and echoes back the certificate submitted by the caller, and the real risk is unauthenticated openssl processing of attacker input.

A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A security flaw in Dromara UJCMS up to 12.3.1 affects the usernameExist function in ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the UserController component. Manipulation of the Username argument results in improper authorization. The attack can be remote. The project has not responded yet.

Vulnerability in Pixelfed up to 0.12.11 affects the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php of the OAuth Scope Handler component. Manipulation of the ID argument leads to missing authentication. The attack can be remote, and the exploit is public. Upgrading to 0.12.10 is recommended (though description says 0.12.11, recommended is 0.12.10 – likely a typo).

The SmartLife app dynamically generates new authentication parameters at runtime. Using them, an attacker can directly register an account with any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified before registration.

Vulnerability in olivier-ls PHP-FTS up to 1.1.3 affects the SearchEngine::matchesSingleFilter function in src/SearchEngine.php of the Filter Matching component. The manipulation leads to incorrect comparison. Remote exploitation is possible, and the exploit is public. Upgrading to 1.1.4 mitigates the issue.

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used.

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined, and Mint.HTTP1.decode_body/5 discards bytes up to the CRLF, so lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ as the terminating chunk. This issue affects mint from 0.1.0 before 1.10.1.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

OpenPanel API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.