CVE Vulnerability Catalog

In n8n before versions 1.123.24, 2.10.4, and 2.12.0, cross-site scripting and open redirect vulnerabilities were found in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies.

An authorization bypass vulnerability in Capgo before version 12.128.2 allows write-scoped API keys to directly modify protected channel configuration fields via PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can alter sensitive channel attributes such as public, allow_emulator, and security-related flags outside intended application routes.

A vulnerability in Capgo before version 12.128.2 is caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, leading to preview misrouting and denial of preview access for victim applications.

A vulnerability in Capgo before version 12.128.2 in the accept_invitation endpoint creates user accounts before captcha validation is enforced. Attackers can bypass captcha protection by sending POST requests with invalid captcha tokens to create unwanted accounts and burn invite links.

A vulnerability in Capgo before version 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary attachments using upload-scoped API keys that bypass plan checks, persist outside normal bundle metadata, and survive app deletion, enabling storage and bandwidth abuse.

A vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged attacker to remotely exploit improper restriction of XML external entity references (XXE). This could lead to unauthorized access to the system.

The multipart parser in Plug.Parsers.MULTIPART does not enforce its :length budget against all consumed resources, allowing an unauthenticated attacker to cause denial of service. Part headers are not counted, and empty parts create temporary files, leading to inode, disk, and memory exhaustion. Affected versions: plug from 1.4.0-rc.0 before 1.16.6, 1.17.0 before 1.17.4, 1.18.0 before 1.18.5, 1.19.1 before 1.19.5, and 1.20.0 before 1.20.3.

A path traversal vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior allows a low-privileged attacker with remote access to read arbitrary files on the system.

In mtr (My Traceroute) version 0.96 and earlier, an out-of-bounds read vulnerability exists in the ipinfo_lookup() function. An attacker can trigger a crash by returning a DNS response larger than 512 bytes with a crafted compression pointer in the answer NAME field.

The Invoice123 plugin for WordPress up to version 1.7.0 inclusive contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can overwrite the API key stored in WordPress options, modify plugin settings, and alter WooCommerce tax rate data.

Stored XSS vulnerability in the file upload functionality of R-SOFT DMS. An authenticated attacker can inject arbitrary HTML and JavaScript into the uploaded file name, which executes when other users view the file list or upload status.

The Jeg Kit for Elementor plugin for WordPress up to version 3.2.6 is vulnerable to stored XSS via the Image Box widget. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts through the 'sg_body_description' parameter.

The Logo Slider plugin for WordPress is vulnerable to stored XSS via the 'lgx_tooltip_position' parameter in versions up to 5.5. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when users visit affected pages.

The JoomSport plugin for WordPress up to version 5.7.9 is vulnerable to time-based SQL injection via the 'event' shortcode attribute. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with contributor-level access or higher to append additional SQL queries.

The Mail Mint plugin for WordPress is vulnerable to generic SQL injection via the 'recipients' parameter in all versions up to and including 1.24.1. Authenticated attackers with administrator-level access can store a malicious payload that is later executed when reading campaigns, allowing extraction of sensitive database information.

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress up to version 4.4.0 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can mark arbitrary pending appointments as Confirmed and forge associated payment records, bypassing payment entirely.

The ICS Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'htmltagtitle' parameter in all versions up to and including 12.0.9 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link, exploiting the wp_ajax_nopriv_r34ics_ajax AJAX action without nonce verification.

The Easy Upload Files During Checkout plugin for WordPress versions up to 3.0.1 is vulnerable to unauthorized access. The ufdc_custom_init() function processes the 'eufdc-delete' parameter without nonce verification, capability check, or attachment ownership validation, allowing unauthenticated attackers to permanently delete arbitrary media library attachments.

The GoodMeet plugin for WordPress up to version 1.1.8 is vulnerable to Cross-Site Request Forgery due to missing nonce verification in the reset_credential() function. An attacker can trick a site administrator into clicking a malicious link, which will delete stored Google Meet API credentials and OAuth tokens, disabling the Google Meet integration on the site.

The Hostel plugin for WordPress up to version 1.1.7 is vulnerable to Stored Cross-Site Scripting via the 'wphostel-book' shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts that execute when users visit affected pages.