CVE Vulnerability Catalog

An unauthenticated bypass vulnerability in SiteGround Security versions up to and including 1.6.6.

An unauthenticated broken authentication vulnerability in RegistrationMagic versions up to and including 6.0.9.8.

An unauthenticated Cross Site Scripting (XSS) vulnerability in SliceWP versions up to and including 1.2.10.

An unauthenticated Cross Site Scripting (XSS) vulnerability in RegistrationMagic versions up to and including 6.0.9.8.

In EasyAdmin (an admin generator for Symfony) versions from 4.0.0 to 4.29.16 and 5.5.1, there is a vulnerability where path-based access control can be bypassed. This occurs because the controller swap happens after the firewall check, and the routeName parameter is not validated. A low-privilege user can execute another route's controller if they know its name, bypassing path-based protections. Routes that enforce their own authorization (e.g., via #[IsGranted]) remain protected. The issue is fixed in versions 4.29.16 and 5.5.1.

In elFinder (a web file manager) before version 2.1.70, there is a vulnerability that allows bypassing file type restrictions during archive extraction. The checkExtractItems() function does not normalize the MIME type, so files with extensions .phtml, .phar, .php5, and .php3 can be extracted even if uploadDeny blocks text/x-php. An attacker with ZIP upload permission can place PHP files in a web-accessible directory and achieve remote code execution. The issue is fixed in version 2.1.70.

In elFinder before version 2.1.70, there is a Server-Side Request Forgery (SSRF) vulnerability during URL uploads. When PHP cURL is unavailable, IP validation can be bypassed via DNS rebinding, allowing connections to internal addresses. Additionally, even when using cURL, there is a blind SSRF path. The issue is fixed in version 2.1.70.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Super Store Finder versions up to and including 7.10.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Tailored Tools versions up to and including 3.0.2.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Email Essentials versions up to and including 6.0.6.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector versions up to 4.0.5.

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated Cross Site Scripting (XSS) in Uncode theme versions up to 2.12.7.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.

Subscriber SQL Injection in Charitable versions up to 1.8.12.1.

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.

Kirby is an open-source content management system. Prior to versions 4.9.5 and 5.5.2, the media handler in src/Cms/Media.php allowed Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalation vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.

Kirby is an open-source content management system. From version 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.