CVE Vulnerability Catalog

The WP Job Portal WordPress plugin before version 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.

The Tutor LMS WordPress plugin before version 3.9.13 fails to verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier. This allows authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.

The Tutor LMS WordPress plugin before version 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved. This allows authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.

The Tutor LMS WordPress plugin before version 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.2 does not restrict allowed PHP classes when unserializing an attacker-supplied form-field value. This allows unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.

The Breeze Cache WordPress plugin before version 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS). This is due to a predictable replacement hash used during HTML minification and abuse of a regular expression, allowing an attacker to inject arbitrary HTML attributes into the final output.

A deserialization vulnerability was found in the retrieval_lm component of AkariAsai self-rag up to commit 1fcdc420e48f50a7d7ab1ece5494221b93252e99, specifically in the Indexer.deserialize_from function of retrieval_lm/src/index.py. The attack can be launched remotely by manipulating the index_meta.faiss argument, and the exploit has been publicly disclosed.

A security flaw was discovered in DedeCMS 5.7.118 in the file /plus/search.php within the Column Management component. Manipulating the Column Name argument allows remote code injection. The exploit has been publicly released and may be used in attacks.

A deserialization vulnerability has been found in HashNeRF-pytorch up to version 82885e698295982504eb6a26d060a6b2473e3706 in the torch.load function of run_nerf.py. Local attackers can manipulate the ckpt_path argument leading to unsafe deserialization.

A vulnerability has been found in WuzhiCMS up to version 4.1.0 in the Attachment API component. The config/listimage function in the file /index.php?m=attachment&f=index&v=upload allows manipulation leading to information disclosure. The attack can be performed remotely and an exploit has been published.

An Arbitrary File Upload vulnerability in Ragic's Enterprise Cloud Database allows unauthenticated remote attackers to upload malicious files, which are then made available for users to download.

A Stored Cross-Site Scripting vulnerability exists in Ragic's Enterprise Cloud Database. Unauthenticated remote attackers can inject persistent JavaScript code that executes in users' browsers upon page load.

A deserialization vulnerability was found in pyod library up to version 3.6.1 in the pyod.utils.persistence.load function. An attacker can remotely manipulate the path argument, leading to unsafe deserialization.

A path traversal vulnerability was found in the better-icons library up to version 1.0.5 in the scan_project_icons/sync_icon component. Manipulating the icons_file argument allows path traversal. The attack requires local access and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability was found in kLOsk adloop up to version 0.9.0. The issue is in the _validate_urls function of src/adloop/ads/write.py, where manipulating the final_url argument allows remote attackers to send requests to internal resources. The exploit is publicly available.

A SQL injection vulnerability has been found in CodeAstro Simple Online Leave Management System 1.0 in the file /SimpleOnlineLeave/admin/dashboard.php via the Name argument. The attack can be performed remotely and the exploit is publicly available.

A path traversal vulnerability was discovered in the run_project component of godot-mcp version 2.0.0. The validatePath function fails to properly sanitize the projectPath argument, allowing a local attacker to access files outside the intended directory. A public exploit increases the risk of exploitation.

A vulnerability was found in makafeli n8n-workflow-builder up to version 0.11.0 in the update_node_from_file function of build/server.cjs. Manipulating the filePath argument allows path traversal, requiring local access. The exploit is publicly available and the project has not responded to the report.

A vulnerability was found in GNU LibreDWG 0.13.4-154-g0b573035 in the decompress_R2004_section function of src/decode.c. Manipulation can cause a heap-based buffer overflow.

A vulnerability was found in usestrix strix up to version 1.0.2, involving inclusion of functionality from an untrusted control sphere via the system_prompt.jinja file in the PyPI Handler component. The attack can be performed remotely but is difficult to exploit. The exploit has been made public.