CVE Vulnerability Catalog

A vulnerability in NGINX Gateway Fabric where user-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret, are rendered directly into NGINX configuration templates without sanitization or escaping.

A vulnerability in NGINX JavaScript (njs) and QuickJS (qjs) engines where an exception during asynchronous access-control evaluation can cause the js_access phase to fail open, allowing the request to proceed instead of being denied.

A vulnerability in the mobile Smart Connect dashboard UI where it can be manipulated by 3rd party apps. When paired with a phishing attack, this could result in escalated privileges of an attacker within the system.

A vulnerability in Grafana (only self-managed instances with Auth Proxy authentication and identity caching enabled) where the Auth Proxy cache key concatenates username and forwarded identity attributes without a delimiter, allowing distinct identities to collide. An authenticated user can spoof a higher-privileged user.

A vulnerability in Craft CMS where GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from arguments without passing through ArgumentManager::prepareArguments(), bypassing site-scope filtering. An attacker with a token scoped to Site A can create, modify, or delete entries in Site B.

A vulnerability in Craft CMS where GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from arguments without passing through ArgumentManager::prepareArguments(), bypassing site-scope filtering. An attacker with a token scoped to Site A can create, modify, or delete entries in Site B.

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users' passwords if the attacker's account has 'Edit users' permission (which doesn't allow changing others' passwords) and lacks 'Administrate users' permission (which is required to change others' passwords).

Incorrect permission assignment for critical resources in Elastic Agent on Windows systems can lead to local privilege escalation. A local user can exploit overly broad access controls to execute arbitrary code and gain SYSTEM privileges.

A path traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of privileged resources. A low-privileged user with Fleet Settings write access could cause administrative actions to affect unintended internal resources, such as user accounts.

The Auto x LINE WordPress plugin through 1.0.0 lacks authorization checks in some REST endpoints, allowing unauthenticated users to update plugin settings, clear logs, etc.

A vulnerability in affected products allows an attacker with basic user privileges to gain access to users' projects. The attacker can modify and delete projects.

Vulnerability in Drupal Screenshot. Affects all versions.

Vulnerability in Drupal Screenshot. Affects all versions.

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL and set a new password, enabling complete control-panel takeover.

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the replacePeerFiles permission is never enforced, allowing an authenticated low-privilege author with replaceFiles permission to overwrite peer asset files.

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method checks permissions only against the user's own provisional draft, then deletes the canonical element without re-checking, allowing an authenticated user without deleteEntriesForSite permission to hard-delete entries.

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites.

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files.

Unauthenticated Cross-Site Request Forgery (CSRF) in Mang Board WP versions up to 2.3.8.

Unauthenticated CSRF vulnerability in Simply Schedule Appointments versions up to 1.6.12.23. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.