CVE Vulnerability Catalog

A weakness has been identified in Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Portal Profile Update. Executing a manipulation of the argument vendor_contact can lead to authorization bypass. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 5.13.27 is able to mitigate this issue. This patch is called f86fd9697ce7bd0d28adbe2e6c5890780482ea90. The affected component should be upgraded.

Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :runtime read policy (a check evaluated per record rather than compiled to a filter), Ash.Policy.Authorizer decides each record in check_result/1 by discarding impossible policy scenarios and inspecting what remains. When every scenario for a record was impossible, meaning no policy can authorize it and it must be forbidden, the empty-scenario branch instead kept the record and returned it as authorized. The fix forbids a record whose scenarios are all impossible. This issue affects ash: from 3.4.44 before 3.32.2.

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled.

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to and including 5.9.2. Authenticated attackers with administrator-level access can append additional SQL queries to existing ones, potentially extracting sensitive information from the database. This is a second-order injection where the payload is stored without sanitization and later used in SQL queries.

The Live Composer – Free WordPress Website Builder plugin is vulnerable to Stored Cross-Site Scripting via the 'dslc_custom_field' shortcode in all versions up to and including 2.1.19. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user visits the page.

The Live Composer – Free WordPress Website Builder plugin is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute in versions up to and including 2.1.19. Insufficient output escaping allows authenticated attackers with contributor-level access to inject arbitrary scripts into the HTML id attribute, which execute when the page is accessed.

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to and including 3.29.11. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user visits the page.

In the ash library, an Incorrect Authorization vulnerability widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved. The unresolved reference defaults to nil, causing predicates like org_id == parent(org_id) to become IS NULL matches, and guards like is_nil(parent(org_id)) activate unrestricted branches, returning records that should be excluded. The fix fails the read with an error when a parent(...) reference cannot be resolved.

In the ash library, a Missing Authorization vulnerability allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. When an atomic strategy is used, the statement updates every row matched by primary key without applying policies, allowing modification of records belonging to other actors or tenants. The fix restricts the atomic path to data layers supporting changeset filters, authorizes each changeset, and merges the policy filter.

In the ash library, an Improper Access Control vulnerability lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. An actor who can set the primary key on a create can silently overwrite an existing record, destroying another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists.

In the ash library, an Uncontrolled Resource Consumption vulnerability lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. The flatten_relationships/2 function eagerly builds the full Cartesian product, leading to combinatorial memory growth. The fix streams the expansion lazily and short-circuits on the first matching scenario.

In the ash library, an Improper Input Validation vulnerability allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. On read, the stored binary UUID does not match the expected format and returns an error, causing every subsequent read of that record to fail. The fix decodes any 16-byte stored binary directly in cast_stored/2.

In the ash library, an Integer Overflow or Wraparound vulnerability lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. The element count is packed into a 16-bit field without range checking, causing wraparound modulo 65,536 and disagreement with the actual number of elements. The fix rejects any vector whose dimension exceeds 65,535.

Uncontrolled resource consumption vulnerability in the ash library allows an attacker to force an expensive regular expression to run on input that should have been rejected by length constraints. The Ash.Type.String.apply_constraints/2 validation did not enforce length limits before applying the :match pattern, enabling catastrophic regex evaluation on large inputs. The fix skips the regex when a length constraint is violated.

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. This can allow selecting and driving an arbitrary registered FileSystemProvider during deserialization of untrusted JSON. Impact is limited if only JDK built-in providers are present, but can be more severe with third-party providers on the classpath.

Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a route handler returns a non-%Plug.Conn{} value, the unexpected_return/2 function interpolates the full inspect of the value (including passwords, tokens, tenant identifiers) into the error message.