CVE Vulnerability Catalog

Contao CMS versions 5.7.0 through 5.7.6 contain a cross-job authorization bypass vulnerability. An authenticated backend user can read attachments from other jobs by manipulating the attachment identifier with '../' sequences.

Contao CMS versions 5.3.35 through 5.3.47 and 5.7.0-RC1 through 5.7.8 contain an SSRF vulnerability in the Feed Reader module. A backend user with module-edit permissions can make the server request internal network services, loopback addresses, or cloud metadata endpoints.

Contao CMS versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6 contain a credential leakage vulnerability via the crawler. The crawler improperly cleans authentication options, potentially sending credentials to external hosts.

Ghost CLI before version 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header in a misconfigured Nginx.

HCL iControl was affected by Improper Error Handling vulnerabilities, involving out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions that can cause errors.

HCL iControl was affected by Auto complete Enabled vulnerabilities, exposing sensitive information such as valid usernames, email addresses used for login, and account identifiers. If accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages, displaying raw server/API error messages to users instead of generic ones, exposing internal endpoint names, request parameters, error codes, and authentication status.

Improper Neutralization of CRLF Sequences in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through comments. Ymlr.document!/2 interpolates comments without validation, allowing injection of newlines and fake keys. Affects versions from 0.0.1 before 5.1.6.

In the SAML protocol implementation of Keycloak, when a client is configured with a wildcard redirect URL, an attacker can craft a request with malicious parameters. After user authentication, Keycloak appends its legitimate response to the attacker's parameters, potentially causing the service provider to process the attacker's data instead of real login information, leading to user login to the wrong account.

In the keycloak-services component of Keycloak, the security check preventing HTTP parameter pollution only inspects the query portion of a redirect URL, ignoring the fragment. When a client is configured with a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. If the client application is not configured correctly, it might trust the attacker's injected data instead of real security information from Keycloak, leading to session fixation or account confusion.

In Keycloak's keycloak-services component, a realm administrator can use a wildcard domain (e.g., *.example.com) to restrict client registration. Due to improper validation, the system accepts any hostname ending with the domain suffix, even if not a legitimate subdomain. An attacker controlling reverse DNS can bypass these restrictions and potentially make unauthorized client modifications.

The WP Go Maps WordPress plugin before version 10.1.04 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The FluentCart WordPress plugin before version 1.5.3 lacks authorization and ownership checks when rendering customer order documents keyed on sequential numeric identifiers. Unauthenticated visitors can enumerate and disclose customer personal data (names, email addresses, billing and shipping addresses, order details) across the store.

The Support Genix WordPress plugin before version 1.4.48 improperly authorizes access to support-ticket attachment downloads. Unauthenticated users who know the stored attachment file name can download other users' private ticket attachments.

The Paid Membership Subscriptions WordPress plugin before version 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory. Unauthenticated users can download these files, containing personal data (PII), while an export artifact is present.

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing and outputting them, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript. On a multisite network, this lets a non-super subsite Administrator plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.

Node.js versions 22.x, 24.x, and 26.x have a vulnerability in the Permission Model that allows process.report to write (and overwrite) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary.

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

The Spring Boot language server logs the raw value of proxy environment variables (https_proxy, etc.) at INFO level when no http.proxy setting is configured. Proxy URLs often contain Basic-auth credentials, which are written without redaction.

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on public submission handlers. Unauthenticated users can submit entries to deactivated or unpublished forms and trigger configured workflows like email notifications.