CVE Vulnerability Catalog

A CSRF vulnerability in SEIKO EPSON Web Config allows unintended operations if a user visits a malicious page while logged in.

A broken object-level access control vulnerability in the Template API of MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization.

The WP Travel Engine WordPress plugin before version 6.8.1 fails to properly validate the source of a user-supplied profile image path before moving the file. This allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path.

An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform operations they would not normally be authorized to do. Affected versions: 9.50 prior to MR1, 9.40 prior to MR3, 9.30 prior to MR5, 9.20 prior to MR7, and all versions of 9.10.

Coolify prior to version 4.0.0-beta.474 has a vulnerability where S3 storage endpoint validation only checks URL format, and testConnection() sends a server-side request to the configured endpoint. This allows an authenticated user with storage management permissions to make Coolify request internal or metadata-service URLs.

In Coolify prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies, accepting X-Forwarded-Host from any source. TrustHosts has a circular caching dependency preventing host validation. An unauthenticated attacker can trigger a password reset and intercept the link with a spoofed domain, stealing the token and taking over the account.

A vulnerability in Coolify prior to version 4.0.0-beta.471 allows an authenticated user to configure a GitHub App source with an api_url field used as the base URL for server-side HTTP requests without private IP or cloud metadata endpoint blocking. This enables requests to internal services or cloud metadata endpoints.

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute when a user accesses the injected page.

In FOSSBilling prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path (MD5 hash). Two different products or order files with the same original filename overwrite each other, causing customers or administrators to receive the wrong file.

In FOSSBilling versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record.

A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.

In the Minosoft client for Minecraft Java Edition, the CryptManager encryption routine sets the AES initialization vector (IV) equal to the secret key instead of a random value. This vulnerability allows chosen-ciphertext/chosen-plaintext attacks, potentially leading to secret key recovery by an attacker.

In FOSSBilling versions 0.5.6 through 0.7.2, when the 'Require Email Confirmation' setting is enabled, a logged-in client with an unverified email address can access all client-area pages, such as wallet balance and transaction history. The API-side enforcement works correctly, but the page-side enforcement is overly permissive, allowing any request starting with '/client'.

FOSSBilling versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in client-facing email history views. Email HTML content is rendered into a JavaScript template literal without proper escaping, allowing an attacker with admin access to inject malicious JavaScript payloads.

A stored cross-site scripting vulnerability exists in the showdown library's parseHeaders function in src/subParsers/makehtml/tables.js, which fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements via double-quote characters in Markdown table headers, achieving stored XSS when untrusted Markdown is rendered with the default GitHub flavor configuration.

In FOSSBilling prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to apply a promo code beyond its configured maximum uses. By sending concurrent checkout requests, a client can obtain unlimited discounted or free orders from a single-use or limited-use promo code.

In FOSSBilling prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. This enables attackers to apply group-restricted promo codes and receive unauthorized discounts.

In Coolify prior to version 4.0.0-beta.474, the POST /api/feedback endpoint lacks authentication, rate limiting, and input validation. This allows arbitrary content to be forwarded directly to a Discord webhook, enabling spam, content injection, and webhook abuse.

Ajenti up to version 2.2.13 has a clickjacking vulnerability in the login and administrative UI. Missing X-Frame-Options and Content-Security-Policy frame-ancestors headers in HTTP responses allow the page to be embedded in an iframe.

An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().