CVE Vulnerability Catalog

The Affiliate Super Assistent plugin for WordPress up to version 1.10.2 is vulnerable to stored cross-site scripting via the doCommentShortcode function due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page.

An incorrect authorization vulnerability in ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value, and AshTypescript.Rpc.ResultProcessor fails to handle this marker in normalize_primitive/1, leading to serialization of the original value. This issue affects versions from 0.11.0 before 0.18.0.

An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. The resolve_typed_struct_field/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. This issue affects versions from 0.11.0 before 0.18.0.

An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. The convert_to_field_atom/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. Additionally, field names longer than 255 characters cause an uncaught SystemLimitError. This issue affects versions from 0.1.0 before 0.18.0.

Eval injection vulnerability in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that results in the absence of specific Windows OS security controls. This vulnerability is due to improper link resolution.

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation is possible, and the exploit is public.

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely, and the exploit is public.

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely, and the exploit is public.

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint to retrieve plaintext super-admin JWT tokens for full platform control.

Tornado before version 6.5.8 does not limit the number of fields when parsing application/x-www-form-urlencoded request bodies. An unauthenticated request with millions of fields can stall the single-threaded event loop and delay every connection.

pnpm before versions 10.34.5 and 11.11.0 accepts a scoped path traversal in the package name in a tarball dependency's package.json manifest. During installation, this can lead to package extraction outside node_modules and overwriting arbitrary filesystem paths, even when --ignore-scripts is used.

Wallos before version 5.0.0 ships a second, near-identical, unauthenticated logo-image search endpoint (endpoints/payments/search.php) that was not hardened against SSRF. It passes the HTTP_PROXY/HTTPS_PROXY environment variable straight into CURLOPT_PROXY.

A flaw was found in WebKitGTK where processing malicious web content can cause memory corruption due to improper memory handling.

In cu silicon up to version 0.1.5, a missing authentication vulnerability was identified in the create_app function of views.py in the edit Endpoint component. The attack can be performed remotely, and the exploit is publicly available.

In kishan0725 Hospital-Management-System 1.0, a SQL injection vulnerability was discovered in /search.php via manipulation of the Contact argument. The attack can be launched remotely, and the exploit has been released publicly.

In MSI Dragon Center up to version 2.0.155.0, an integer overflow vulnerability was found in the MmioWritePath function in the NTIOLib_X64.sys library. The attack requires local access, and the exploit has been made public.

pnpm before versions 10.34.5 and from 11.0.0 until 11.11.0 parses package names from attacker-controlled pnpm-lock.yaml keys without validation, which can lead to package contents being written outside node_modules during installation. If lifecycle scripts are allowed, this can enable code execution.

A potential security vulnerability has been identified in HP ImageDiags for versions prior to 5.0.0.36, which could allow a local attacker to escalate privileges due to insufficient access controls.

Unauthenticated Cross Site Scripting (XSS) vulnerability exists in WordPress Social Login and Register versions up to 7.8.2.