CVE Vulnerability Catalog

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash. This allows an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist. This allows users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.

Memory corruption while processing rear sensor IOCTL calls.

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user's session.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests — reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture into the database, in reversible base64 form, any WordPress Application Password or HTTP Basic credential presented to `/wp-admin/` by a legitimate integration, or to overwrite the stored credential with an attacker-chosen value by sending an anonymous request carrying a crafted `Authorization: Basic` header.

In djust before version 1.0.7, the WebSocket path (handle_mount and ViewRuntime._build_request) rebuilds HttpRequest without HTTP_HOST, causing get_host() to default to "testserver". This leads to incorrect tenant resolution on the live path — with STRICT_MODE=False it can cause cross-tenant disclosure, and with the default it returns empty querysets. Fixed in 1.0.7.

In djust before version 1.0.7, assigning a Django Model instance to a public view attribute serialized the entire object to the client without a sensitive-field denylist. This sent fields such as password hashes, privilege flags (is_staff, is_superuser), tokens, and other PII to the browser. Fixed in 1.0.7.

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses. A comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment, so an address like [email protected](x)evil.com is read as the domain good-corp.comevil.com. This can lead to delivery to an attacker-controlled domain. Fixed in 9.1.0.

Nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent() using the legacy three-argument signature. As a result, plugin or application code can be induced to read arbitrary local files or issue outbound HTTP(S) requests (SSRF), bypassing the enabled sandbox. Fixed in 9.1.1.

Craft CMS versions 5.0.0 through 5.10.12 treat a database connection failure as meaning Craft is not installed, making anonymous installer actions (including install/validate-site) reachable on an installed production site when PHP remains available but MySQL is not. An authenticated attacker with a valid guest session and CSRF token can read environment variables, including the security key, database credentials, or API keys. Fixed in 5.10.13.

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users. Fixed in 5.10.13.

Craft CMS 5.0.0 through 5.10.12 contains a broken access control flaw in the nested-elements reorder endpoint. An authenticated user with view-only permissions can reorder Matrix blocks or Address fields in another author's content without save access.

n8n before versions 1.123.76, 2.37.7, and 2.38.2 has a vulnerability in the source control push endpoint that allows an authenticated project user to delete files (workflows and credentials) from projects they do not have access to. Exploitation requires the Source Control (Environments) enterprise feature to be enabled.

n8n before versions 1.123.76, 2.37.7, and 2.38.2 has a vulnerability in the Git node that allows an authenticated user to read Git repositories outside the configured directory (N8N_RESTRICT_FILE_ACCESS_TO). By nesting the repository below the configured path, the user can bypass the URL validation and git actually reads data from outside the allowed area.

AVideo through version 29.0 fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can send POST requests to the comment API endpoint with arbitrary video IDs.

AVideo through version 29.0 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can send like and dislike requests to increment vote counters on videos they cannot watch.