CVE Vulnerability Catalog

Envira Gallery Lite before version 1.16.2 has a missing authorization vulnerability in its gallery conversion REST endpoint, allowing lower-privileged authenticated users to create and publish galleries without required capabilities. Attackers can also supply arbitrary image IDs without ownership verification to publish unauthorized content.

Improper input validation vulnerability in Apache Camel Karavan. When a deployment is started, Karavan applies all resources from kubernetes.yaml without restricting resource kinds, security-sensitive pod options, or namespace.

Path traversal vulnerability in Apache Camel Karavan. A project file name supplied via the API is used verbatim as a path segment, allowing file writes outside the project directory to any writable location.

Affinity by Canva before version 3.3.1 did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and dereference of an untrusted pointer. A crafted document could cause memory corruption or application crash.

The Affinity by Canva application before 3.3.1 did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A crafted Affinity document, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application before 3.3.1 did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A crafted Affinity document, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Testimonials by BestWebSoft WordPress plugin through version 1.0.8 does not sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.

The Shipping for Nova Poshta WordPress plugin through version 1.19.8 does not perform any authorization, nonce, or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request using the store's own stored API credentials.

The Livees Checkout WordPress plugin through version 7.0.2 does not perform any capability, nonce, or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.

The GDPR Data Request Form WordPress plugin through version 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.

The Scripts n Styles plugin by unFocus Projects through version 3.5.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects Scripts n Styles from n/a through 3.5.8.

The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.

The Restrict User Access – Membership Plugin with Force by DEV Institute through version 2.8.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects Restrict User Access – Membership Plugin with Force from n/a through 2.8.1.

The Html5 Audio Player plugin by bPlugins through version 2.8.8 has a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation. This issue affects Html5 Audio Player from n/a through 2.8.8.

The All Bootstrap Blocks WordPress plugin up to version 1.3.31 exposes sensitive system information to unauthorized control spheres. Attackers can exploit this to retrieve embedded sensitive data.

The Asgaros Forum plugin up to version 3.4.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to forum functions.

The AI Translation for Polylang plugin up to version 1.6.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to translation functions.

The Super Payments WordPress plugin before version 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key is empty by default. This allows unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

In Apache CXF, STSTokenValidator stored the SAML assertion signature verification result in an object shared across all requests, allowing one request to read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate that was accepted as trusted without reaching the STS. Only services using STSTokenValidator without alwaysValidateToSts set are affected.

Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens using a non-cryptographic 32-bit hash (Java Arrays.hashCode/hashCode()) and treated a cache hit as proof of validation. An attacker could craft a token (e.g., UsernameToken or self-signed SAML Assertion) whose hash collides with a cached entry, allowing acceptance without password validation, signature trust verification, or STS call. This could let the attacker authenticate as another user and obtain STS-signed tokens for that identity.