CVE Vulnerability Catalog

A vulnerability in GPAC up to f1219cde affects the function gf_node_list_insert_child in scenegraph/base_scenegraph.c, leading to memory corruption. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended to resolve the issue.

A vulnerability in GPAC up to f1219cde affects the function gf_node_get_name_and_id in scenegraph/base_scenegraph.c, leading to use-after-free. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended.

A vulnerability in GPAC up to f1219cde affects the function gf_url_concatenate_ex in utils/url.c, leading to a heap-based buffer overflow. The attack must be approached locally. Upgrading to version abi-16.23 is recommended to address the issue.

A heap-based buffer overflow has been detected in GPAC in the mpgviddmx_process function of filters/reframe_mpgvid.c in the MPEG Video Reframer component. The vulnerability can be exploited remotely and a public exploit is available. The issue is fixed in version abi-16.23.

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0 in the move_uploaded_file function of production/edit_picture.php in the Profile Picture Upload component. Manipulating the File argument results in unrestricted file upload. The attack can be carried out remotely and a public exploit is available.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.7.7 via the 'mediaId' parameter due to missing validation on a user-controlled key. An authenticated attacker with subscriber-level access or above can access and retrieve transcribed contents of private audio attachments belonging to other users, including Administrators. The vulnerability requires the Public API module to be enabled.

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'position_button' parameter in all versions up to and including 2.8.1 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_shedule_objective' schedule_slot parameter in all versions up to and including 4.1.23 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page.

A weakness has been identified in stamparm maltrail up to 3.0.1 in the _blacklist function of core/httpd.py in the Blacklist Endpoint component. Manipulation can lead to missing authentication. The attack can be launched remotely and a public exploit is available. The issue is fixed in version 3.1.

A flaw was found in hawtio-operator: when a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.

A flaw was found in hawtio-operator: the operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0.

The WP Directory Kit WordPress plugin through version 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement. This allows authenticated users with access to the page builder (Editor role and above) to perform SQL injection attacks that execute when the affected page is rendered.

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.

A vulnerability was detected in D-Link DIR-882 up to version 20260814. It affects the main function in /HNAP1/dllog.cgi of the CGI Binary component. Manipulation leads to information disclosure. The attack can be launched remotely, and the exploit is public.

A vulnerability was detected in vllm-project vLLM up to version 0.27.1. It affects an unknown part of /v1/chat/completions in the Jinja Template Rendering component. Manipulation of the chat_template argument causes resource consumption. The attack can be initiated remotely, and the exploit is public. A pull request to fix the issue awaits acceptance.

A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown function in /dashboard/userprofile.php of the Profile Upload component. Manipulation of the image argument results in unrestricted upload. The attack can be initiated remotely, and the exploit is public.

A vulnerability in bizwell xClick due to improper input validation allows Stored XSS. This issue affects versions R2, R3, and R3.1.

A vulnerability was detected in Yao through v1.0.0-rc22. The system authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.