CVE Vulnerability Catalog

Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability related to inconsistent ACL checks for mutating webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Dragonfly before version 1.40.0 has a vulnerability in CMS.INITBYDIM and CMS.INITBYPROW commands where an arithmetic overflow in buffer size calculation leads to undersized buffer allocation. This allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server.

Kestra before version 1.3.24 has a stored XSS vulnerability in its custom Markdown parser. A user with permission to create or update a Flow description can inject JavaScript event-handler attributes via the [[link]] syntax, causing script execution when another user opens the description or information panel.

Vvveb before version 1.0.8.4 has a vulnerability in backend comment operations that allows a low-privileged Author to manage comments under another Author's posts. Lack of ownership verification enables reading comment content, email addresses, changing moderation status, editing or deleting comments.

Vvveb before version 1.0.8.4 has a vulnerability in backend post operations that allows a low-privileged Author to access posts owned by another Author. Lack of consistent ownership enforcement enables viewing metadata, duplicating or deleting posts, potentially exposing private drafts and causing data loss.

Vvveb before version 1.0.8.4 has a vulnerability in backend digital asset operations that allows a low-privileged Vendor to access digital assets linked to another Vendor's products. Lack of ownership boundary enforcement enables listing assets, reading names and file metadata, editing metadata, or deleting asset records.

MyBB before version 1.8.40 has a stored JavaScript code injection vulnerability in checkbox and multiselect profile field types. Profile field validation does not properly handle non-array values, allowing malicious code to be stored and rendered without processing by the MyCode parser.

MyBB before version 1.8.40 has a JavaScript code injection vulnerability in the Buddy/Ignore component due to improper username sanitization. Specially crafted usernames can leave unescaped single quotes, which can be exploited to execute scripts.

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application.

The Entries component in Brainstorm Force SureForms versions less than 2.12.3 does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, allowing a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.

RAGFlow before version 0.26.3 has a server-side request forgery vulnerability in the agent workflow Invoke component. The component builds an outbound request URL from canvas configuration and template variables and passes it to requests.get/post/put without safety validation, allowing access to internal network resources.

A vulnerability in TaxoPress (up to version 3.51.0) involves deserialization of untrusted data, allowing Object Injection.

Starter Templates by Kadence WP versions up to 2.3.3 contain an unauthenticated Denial of Service (DoS) vulnerability. An attacker can cause service unavailability without authentication.

Unauthenticated Broken Access Control vulnerability in Charitable versions up to 1.8.11.3.

Unauthenticated Local File Inclusion vulnerability in Restaurant Menu by MotoPress versions up to 2.4.11.

Subscriber Broken Authentication vulnerability in MWB HubSpot for WooCommerce versions up to 1.6.7.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Subscribe2 versions up to 10.46.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Site Reviews versions up to 8.2.0.