CVE Vulnerability Catalog

TypeBot versions prior to 3.16.0 have incomplete SSRF protection for Webhook/HTTP Request blocks. Validation only checks hostname literals and IP formats but does not resolve DNS before allowing the request.

Typebot versions 3.15.2 and earlier have an HTML/JS injection vulnerability in the RatingButton component, which renders the customIcon.svg field via innerHTML without sanitization. An attacker can inject malicious code that executes in the context of an authenticated user in the builder panel, bypassing the Web Worker sandbox.

Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors.

Improper authorization in the Active Directory browsing feature of Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server.

A vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source occurs when a rewrite directive uses a regex pattern with overlapping PCRE captures and a replacement string referencing multiple captures. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.

An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.

Follett Software's Destiny Library Manager version 22_0_2_rc1 has a directory traversal vulnerability that allows remote attackers to read arbitrary system and application files via the image parameter. Fixed in v.22.5 AU1.

In shell-quote, the quote() function did not validate object-token inputs against the operator model used by parse(). The .op field was backslash-escaped character by character using /(.)/g, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in .op therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The fix replaces per-character escape with strict shape validation.

Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure.

The fix for CVE-2025-48913 in Apache CXF was incomplete, meaning another code path might allow code execution if untrusted users can configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6, or 3.6.11.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation, allowing an unauthenticated remote attacker to crash the server process and cause a full service outage via a crafted binary WebSocket message.

SQL injection vulnerability in STER allows an authenticated attacker to inject SQL via search filters, potentially reading sensitive data of other users or other application data.

Vulnerability in the Ditty plugin for WordPress up to version 3.1.65 – missing authorization check in the ditty_init AJAX endpoint allows unauthenticated attackers to retrieve content of non-public Dittys (including drafts, pending, scheduled, and disabled entries) by enumerating post IDs.

Insecure Direct Object Reference (IDOR) vulnerability in the AudioIgniter plugin for WordPress up to version 2.0.2. The handle_playlist_endpoint() function returns playlist track data without authentication, allowing unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, cover images) of any playlist, including draft, private, pending, or trash status.

The Easy Elements for Elementor plugin for WordPress up to version 1.4.5 contains a privilege escalation vulnerability in the easyel_handle_register() function. An unauthenticated attacker can register a new account with full administrator privileges by supplying custom_meta[wp_capabilities][administrator]=1 in an AJAX request.

The WP ERP Pro plugin for WordPress in all versions up to and including 1.5.1 is vulnerable to SQL injection via the 'search_key' parameter. This is due to insufficient escaping and preparation of the SQL query, allowing unauthenticated attackers to append additional SQL queries to extract sensitive information.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

The RSA and DSA public key parsers did not enforce size limits on key parameters, allowing a DoS attack by sending a crafted key with an excessively large modulus or DSA parameter. Signature verification could take several minutes.

A path traversal vulnerability has been found in UniFi OS devices that can be exploited by an actor with network access and low privileges. It allows access to files on the underlying system that could be manipulated to obtain sensitive information.

Concrete CMS 9 before 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). An attacker can trick an administrator into performing unwanted file operations.