CVE Vulnerability Catalog

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the theft of local privacy data.

The DHL Shipping Germany for WooCommerce plugin before version 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file. On servers that do not honor .htaccess (e.g., nginx), an unauthenticated visitor can download stored shipping labels (containing customer name and postal address) by requesting predictable filenames.

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

The GeoDirectory WordPress plugin before version 2.8.110 does not sanitize and escape a place-category setting before outputting it in an admin page, allowing high-privilege users (editors and above) to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed (e.g., in multisite).

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a, impacting the function SplitTokens/ShuntingYard in the file engine/query/expr/expr.cpp of the Filter Parser component. Such manipulation leads to improper check for unusual conditions. The attack needs to be performed locally, and the exploit has been disclosed publicly.

Baserow up to version 2.3.2 has an issue in the BaserowImpersonateAuthTokenSerializer function within the Inactive Non-Staff User Handler component, leading to improper authorization. Remote exploitation is possible but requires high complexity. The maintainer suggests it may be more of a bug than a vulnerability, but recommends upgrading to 2.3.3.

Open WebUI versions 0.9.6 through 0.11.0 allow an authenticated user to cancel another user's in-flight tasks (e.g., model response generation) by knowing the chat ID. This occurs because the delete operation cancels tasks before checking permissions. The issue is fixed in version 0.11.0.

A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI is executed with elevated privileges.

A weakness has been identified in Systerel S2OPC up to 1.7.3, affecting the function LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse in the file src/ClientServer/frontend/client_wrapper/internal/state_machine.c of the DeleteMonitoredItemsRequest Handler component. This manipulation causes an out-of-bounds read. The attack can only be executed locally, and the exploit has been made public.

Cross-Site Request Forgery vulnerability in the Oidcc.Plug.AuthorizationCallback module of the oidcc_plug library. An attacker can cause the victim's browser to complete an authorization flow the victim never initiated, leading to the victim being signed in to the attacker's account.

The Brizy WordPress plugin before version 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.

The Brizy WordPress plugin before version 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitize part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.

The MonsterInsights WordPress plugin before version 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions. When the plugin is not connected to Google Analytics, the HMAC signing key is empty, allowing unauthenticated attackers to forge a valid signature and overwrite a configuration value, disrupting server-side analytics in Manual GA4 mode.

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.

A flaw in the backchannel logout endpoint of the keycloak-services component (part of Red Hat Build of Keycloak) allows the system to incorrectly accept logout requests without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. An attacker knowing session details can force a user to be logged out.

A flaw in the Node.js HTTP client can cause request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount`/`maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing, particularly hiding `Content-Length` from userland while the request body is still delivered.

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set.

Misskey versions 2025.3.2 up to (but not including) 2026.5.4 have a missing permission check that allows access to certain Direct Messages data regardless of account permissions. Notes with 'specified' visibility are not affected. Fixed in version 2026.5.4.

OpenAkita up to version 1.27.12 has an XSS vulnerability in the File Upload API at /api/upload. Manipulating the File argument allows remote script execution. Exploitation is difficult but the exploit is public. The vendor did not respond.