CVE Vulnerability Catalog

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know. This bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite WordPress plugin before 2.17.0.

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads can overflow stack buffers, causing a crash of the weblinker daemon.

A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges.

An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.

An OS command injection vulnerability exists in the PAM session cleanup routines during SSH session termination on Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges.

A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root.

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user can bypass authorization restrictions and assign administrative roles to a target account, leading to localized privilege escalation.

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine, and malformed account names can cause the execution of embedded shell metacharacters.

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.

An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames, the receiving switch processes them at an elevated level without proper verification. An attacker on a single fabric-connected switch can escalate privileges and execute arbitrary root commands locally or across other managed fabric members.

In Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1, handling of specific download protocols uses unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed via a shell. Because control characters and shell metacharacters are not stripped, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.

Brocade Fabric OS before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure can prevent the web management service from starting or recovering, leading to a persistent Denial of Service (DoS).

The Super Forms plugin for WordPress up to version 6.3.316 contains an arbitrary directory deletion vulnerability. This is due to insufficient validation of attacker-controlled JSON fields and an ineffective ABSPATH guard that can be easily bypassed. An unauthenticated attacker can recursively delete arbitrary directories on the server, including the WordPress root directory, provided the administrator has enabled the 'Delete files from server after form submissions' setting.

The Super Forms – Drag & Drop Form Builder plugin for WordPress up to version 6.3.316 is vulnerable to Unrestricted File Type Upload via the upload_files function. Missing file type validation allows authenticated attackers with Subscriber-level access and above to upload executable files, leading to remote code execution. The attack requires poisoning _super_elements post meta via the super_save_form AJAX handler, which lacks capability and nonce checks, and then uploading via super_upload_files without authentication.

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. updateSmartList sets creatorId to the caller identity and can set visibility to PRIVATE, locking out the original owner.

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, allowing an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

An Improper Input Validation vulnerability in Brocade ASCG before v3.0 affects registered case credentials. A local authenticated user can provide invalid inputs like special characters, leading to a Denial of Service (DoS) when collecting 'supportsave' from a Brocade Switch.

In Brocade ASCG before v3.0, several security-related HTTP headers were missing in various URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.