CVE Vulnerability Catalog

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the /login.php file. Manipulation of the user_name argument results in SQL injection. The attack can be executed remotely, and the exploit has been released to the public.

A vulnerability was determined in Tenda HG10 (version 300001138) in the formWanRedirect function of the /boaform/formWanRedirect file in the Boa Web Server component. Executing a manipulation of the 'if' argument can lead to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_category. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_voting. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=save_user. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been published.

The HivePress Authentication plugin for WordPress up to version 1.1.4 is vulnerable to authentication bypass via the access_token parameter. The authenticate_user function trusts responses from Facebook Graph API without verifying the application ID, allowing unauthenticated attackers to log in as any WordPress user, including administrators, if they have the victim's access token.

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).

An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs.

The libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset requests for any account with a malicious Host header, intercept the reset token from victim emails, and complete account takeover including super-admin accounts.

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write permissions can create an invitation with a dot-keyed super flag in the access payload that bypasses the guard and persists to the new account. Attackers can accept the invitation through the public endpoint without real invitee interaction to create a super-admin account and immediately receive a valid JWT for full site control.

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer with access to the privileged IPC bridge, and execute system commands or steal login credentials.

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.