CVE Vulnerability Catalog

The plugin/TopMenu/menus.json.php endpoint in WWBN AVideo does not require authentication. Unauthenticated attackers can retrieve all menu data, including inactive and admin-only menu names not displayed in the public navbar.

The playListAddVideo.json.php endpoint in WWBN AVideo fails to validate watch permissions when adding videos to playlists. Authenticated attackers can add password-protected videos they cannot watch to playlists they own by submitting video ID and playlist ID parameters.

The plugin/TopMenu/menuItems.json.php endpoint in WWBN AVideo contains a missing authentication vulnerability. Unauthenticated attackers can read inactive admin menu items by submitting a POST request with a menuId parameter, including hidden menu item URLs with embedded admin-tool secret query parameters not exposed in the public navbar.

The playlistsFromUser.json.php endpoint in WWBN AVideo contains a missing authorization vulnerability. Unauthenticated attackers can read private playlists by requesting another user's identifier, including Favorite and Watch Later playlists, due to improper cache keying that conflates requests across different user contexts.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to authorize access to the adsInfo API endpoint. An unauthenticated attacker can call adsInfo with a videos_id parameter to obtain the owner's user ID and personalized ad creative URLs without any permission checks.

Flowise versions up to and including 3.1.3 mount the POST /api/v1/node-load-method/:name endpoint without any route-level permission check and invoke component loadMethods with attacker-controlled nodeName, loadMethod, inputs, and credential value. The selected credential is resolved by raw Credential.id via getCredentialData() and decrypted without verifying Credential.workspaceId against the caller's active or shared workspace. An authenticated low-privilege user (or workspace API key) in one workspace can supply a credential ID owned by another workspace, causing Flowise to act as a confused deputy, performing third-party provider calls with the victim workspace's credential and returning provider metadata to the attacker. Statically identified affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables. The raw credential secret itself is not returned to the attacker. This issue is fixed in version 3.1.4.

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record, including the bcrypt password hash and temporary tokens. An attacker can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking.

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. An authenticated attacker with Contributor-level access and above who can use Elementor can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044 through A, AN953 through A, and SW300052 through 2.6.

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress in all versions up to and including 4.2.1 is vulnerable to generic SQL Injection via URL Path due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables authenticated attackers with subscriber-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database. It is only exploitable when the [mpg_spintax] shortcode is rendered in site-wide content such as a footer or template part.

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. An authenticated attacker with subscriber-level access or above can append additional SQL queries into existing queries to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled and the egoi_mapping option to be truthy.

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. An unauthenticated attacker can extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, so no authenticated session or prior action is needed.

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). An unauthenticated attacker can overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings.

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product. This allows users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers. This allows unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions. This allows unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier. This allows unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.