CVE Vulnerability Catalog

WWBN AVideo (up to e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The attempt counter is stored via a cache layer that silently discards writes for clients identified as bots by isBot(). Since isBot() treats a missing User-Agent header as a bot, an attacker can submit unlimited login attempts, enabling unrestricted password-guessing attacks.

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, so an attacker can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute. The script can access Tauri IPC commands, escalating to arbitrary code execution.

Keploy versions 3.1.0 through 3.6.25 (fixed in 3.6.26) bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access /agent/pcap/keylog to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences or an absolute path resolves outside ~/Downloads. The command fetches attacker-controlled content from the supplied URL and writes it to that path, potentially overwriting user-writable files and installing persistence, leading to code execution.

A vulnerability was detected in vastsa FileCodeBox up to 2.3. The vulnerability affects the function update_file_usage in the file apps/base/views.py of the component Pickup Limit Handler. Performing a manipulation results in race condition. The attack can be initiated remotely. The exploit is public. Upgrading to version 2.5.0 resolves the issue.

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing and outputting them in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

A vulnerability was discovered in NASA cFS up to 7.0.1, affecting the CFE_SB_GetUserDataLength function in cfe_sb_util.c of the cFE Software Bus component. Manipulating TotalMsgSize/HdrSize results in integer underflow. The attack can be initiated remotely, and the vendor did not respond.

A vulnerability was found in NASA Trick 19.6.0 in the function JSONVariableServerThread::parse_request in the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp, part of the TCP Socket Handler component. Manipulation causes a stack-based buffer overflow. The attack can be carried out remotely.

The oidcc library (erlef) has an improper verification of cryptographic signature vulnerability. An unauthenticated attacker can impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. The library accepts a JWE wrapping unsigned claims as fully validated, allowing minting tokens with arbitrary sub, iss, and aud without the provider's signing key.

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.

iFlytek astron-agent through version 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

Sudo through version 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

KubeEdge CloudCore through version 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade scheduling.

Documenso before version 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

Rodauth before version 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.