CVE Vulnerability Catalog

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.

The ChatHelp plugin for WordPress up to version 3.5.1 is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' shortcode attributes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when users visit affected pages.

The Kirki plugin for WordPress is vulnerable to Directory Traversal via the 'family' parameter. Authenticated attackers with editor-level access or higher can delete arbitrary directories on the server.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.

The Ninja Forms - Excel Export plugin for WordPress up to version 3.3.6 is vulnerable to Stored Cross-Site Scripting. This is due to missing capability checks, nonce verification, and input sanitization in the save_filter() AJAX handler, which stores the raw $_POST['filter'] array into a WordPress option, combined with the get_filter_row() method on the admin Excel Export screen concatenating stored filter values directly into HTML attributes without esc_attr().

The pCloud WP Backup plugin for WordPress up to version 2.0.3 is vulnerable to sensitive information exposure via the wp2pcl_ajax_process_request_inner function. Authenticated attackers with subscriber-level access or higher can force the generation of a full-site backup archive written to a publicly accessible tmp/ directory, exposing database credentials, WordPress secret salts, and the complete PHP source tree.

The Fense Proxy & VPN Blocker plugin for WordPress up to version 3.0.1 is vulnerable to unauthorized data modification due to missing capability checks and nonce validation in the fense_bpvt_save_settings() function. This function is registered to both authenticated and unauthenticated AJAX hooks, allowing unauthenticated attackers to delete plugin options and transients, resetting the API key cache and forcing a state refetch.

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This allows authenticated attackers with subscriber-level access and above to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to enumerate any Ninja Forms form ID and download all stored submission data as an XLSX file.

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay Gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to and including 3.2.2 due to insufficient input sanitization and output escaping.

Grav before version 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.

The Grav Login plugin before version 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task. An attacker can trick a logged-in user into visiting a malicious page, which regenerates a new TOTP secret without any anti-CSRF nonce or Origin/Referer check, invalidating the existing two-factor authentication key.

A broken access control vulnerability in Grav Flex-Objects before version 1.4.3 allows authenticated users with api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create, read, update, delete, and export objects from any directory lacking explicit permissions, bypassing intended authorization controls.

An authorization bypass vulnerability in OpenClaw before version 2026.5.18 in skill command dispatch allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can bypass tool policy restrictions through configured input paths to perform unauthorized actions when the affected feature is enabled and reachable.

An authorization bypass vulnerability in OpenClaw MS Teams before version 2026.5.12 allows the allowFrom feature to bind to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting this mutable display name binding.

OpenClaw 2026.5.12 before 2026.5.26 contains an incorrect authorization vulnerability in the ClickClack allowFrom feature. When enabled, a lower-trust caller or configured input path can execute actions beyond intended authorization, including running non-allowlisted commands.

In OpenClaw 2026.2.25 before 2026.5.26, a lower-trust caller or configured input path can bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

OpenClaw 2026.4.20 before 2026.5.28 contains a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (SSRF).

OpenClaw before version 2026.5.28 Bot Framework has an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by supplying malicious serviceUrl values.

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.