CVE Vulnerability Catalog

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request. Unauthenticated attackers could inject arbitrary email addresses and contact details into the site owner's Mailchimp account as confirmed subscribers.

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions. This allows unauthenticated users to add or delete reservation types in the plugin's configuration.

The Court Reservation WordPress plugin before 1.12.4 does not perform authorization or nonce verification on one of its challenge-management actions. This allows unauthenticated users to delete arbitrary tournament-ladder challenge records along with the linked court-booking event.

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state. This allows unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query. This allows authenticated attackers with editor-level access to perform blind SQL injection attacks.

The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation. This allows unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link. This allows unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default. This allows unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.

Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts).

A vulnerability was found in a2ui up to 0.10.6 affecting the DataContext.resolveSignal function in data-context.ts of the Resolver component. The manipulation results in resource consumption and can be triggered remotely. The exploit has been publicly disclosed and a patch is available as c76e17272e52c12c6dcf68905b1df978c39e9aa5.

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in versions up to 1.4.05. Due to insufficient input sanitization and output escaping, an authenticated attacker with Subscriber-level access or higher can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the attacker to be assigned as a calendar owner.

GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c. The flaw can lead to memory corruption when processing crafted VFAT filesystem data.

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_body_read(), denying certificate status checks.

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

a2ui up to 0.10.6 contains a vulnerability in unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the Binder component, leading to resource consumption. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be used.

a2ui up to 0.10.6 contains a vulnerability in the DataModel.set function of the file renderers/web_core/src/v0_9/state/data-model.ts, leading to resource consumption. The attack can be launched remotely, and the exploit has been published and may be used.

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causing heap out-of-bounds reads that crash applications or expose adjacent heap memory.

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances.