CVE Vulnerability Catalog

The MxChat – AI Chatbot & Content Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 3.2.10 due to insufficient input sanitization and output escaping.

The MultiVendorX plugin for WordPress is vulnerable to generic SQL injection via the 'order_by' parameter in versions up to and including 5.0.9. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with subscriber-level access or higher to append additional SQL queries.

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status function. This allows authenticated attackers with contributor-level access and above to extract titles, full content, excerpts, dates, authors, and custom-field metadata of other users' pending-review, scheduled, and trashed posts by embedding a crafted [catlist] shortcode in their own draft and previewing it.

The Landing Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.5.3.6. Missing nonce validation in the ulpb_admin_ajax function allows unauthenticated attackers to perform unauthorized actions on posts and post meta.

A vulnerability was found in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 in an unknown function of the file proses/add.php. Manipulation of the argument kd_cs leads to authorization bypass. The attack can be carried out remotely.

A vulnerability in Anubis Web AI Firewall Utility from version 1.22.0 to 1.26.0-pre1 allows an attacker to bypass the Anubis challenge by manipulating the X-Original-URI header. The PathChecker.Check() function trusted the client-controlled header before matching r.URL.Path, enabling the use of ALLOW rules for patterns like ^/\.well-known/.*$.

Wekan before version 9.34 has a vulnerability in the cloneBoard method that allows an authenticated user to clone any board (knowing its ID) without permission checks. This enables reading cards, comments, attachments, member information, and activities from private boards.

In Wekan prior to version 9.32, webhook URLs stored from user input are not validated against internal network connections. A board administrator can configure webhooks that cause server-side requests to internal or metadata services.

In Wekan prior to version 9.32, REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields.

Stored Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI plugin of AVideo (versions 29.0 and below). An attacker can inject malicious JavaScript by setting a YouTube video title, which is then rendered on the AVideo homepage without HTML encoding.

AVideo prior to version 29.0 contains an unauthenticated Reflected XSS vulnerability in YouTubeAPI Gallery Pagination. The $_GET['search'] parameter is concatenated directly into the href attribute of pagination links without proper encoding, allowing arbitrary JavaScript injection.

Dulwich through version 1.1.0 is missing SSH host key verification in contrib/paramiko_vendor.py. This means that during SSH connections, the server's public key is not checked for trustworthiness.

Heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0. An attacker can cause a Denial of Service (DoS) by supplying crafted input.

A Cross Site Scripting (XSS) vulnerability has been discovered in xxl-job-admin version 3.0.0. A remote attacker can exploit a crafted HTTP GET request containing a malicious script to execute arbitrary code in the victim's browser context.

Listmonk prior to version 6.2.0 contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. The user-controlled query parameter is passed to QuerySubscribersForExport without validation, allowing an authenticated user with appropriate permissions to read arbitrary database tables and execute data-modifying PostgreSQL CTEs.

In 9Router prior to version 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header.

In n8n-MCP prior to version 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations.

A vulnerability in NocoBase prior to version 2.1.19 allowed command injection during PostgreSQL backup restoration. An attacker with backup management privileges could inject malicious values into the database.schema field in _metadata.json, which was then interpolated into a shell command executed via child_process.exec().

CVE-2026-55399 is a resource exhaustion vulnerability in Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.

In NocoBase version 2.0.59 and earlier, the checkSQL() function in the collection-sql plugin fails to block access to PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity. An admin-role user can read password hashes and database metadata through the SQL Collection feature.