CVE Vulnerability Catalog

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. This includes opt-in parameterize=false queries, IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments, and LIKE ESCAPE literals.

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header, WHEELS_TEST_CONTEXT cookie, or a test-runner path in the URL. The alternate application uses the same configuration, environment, datasource and debug settings; this is not an authentication bypass or data/debug escalation, but it can bypass maintenance mode, provide a second set of rate-limit counters, and trigger additional startup side effects. This is fixed in 4.2.0.

Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. By uploading a crafted SVG, it is possible to execute scripting in the browser when the SVG image is viewed directly by its URL. The issue is mitigated because Backdrop embeds all uploaded SVG images within <img> tags, which prevents script execution.

The Flying Scripts plugin for WordPress (versions up to and including 1.2.4) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload uses only kses-allowed elements, and the XSS is introduced post-save by the plugin's output-buffer rewriter.

The RSS Aggregator by Feedzy plugin for WordPress (versions up to and including 5.2.11) is vulnerable to stored cross-site scripting via the 'media:thumbnail@url' parameter due to insufficient input sanitization and output escaping. The attacker must control an external RSS feed that the target site has already configured for import.

The Colibri Page Builder plugin for WordPress (versions up to and including 1.0.390) is vulnerable to stored cross-site scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. The payload survives storage because the widened comment allow-list permits SVG elements, and execution occurs when colibri.js reads the stored data-target value and passes it to jQuery().

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress in versions up to and including 1.3.0 is vulnerable to Directory Traversal via the 's' parameter. An authenticated attacker with administrator-level access can read arbitrary files on the server, and when the Optimize CSS feature is enabled, an unauthenticated visitor can trigger the attack with a single crafted GET request.

The Customer Email Verification for WooCommerce plugin (versions up to and including 3.3.0) is vulnerable to privilege escalation via the 'alg_wc_ev_verify_email' parameter. The activation code is generated using wp_rand(100), yielding only ~101 possible values, and the verify() handler lacks nonce checks and rate limiting.

The FluentCart plugin for WordPress in versions up to and including 1.7.0 is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter due to insufficient escaping of user input. An authenticated attacker with custom-level access can append SQL queries to extract sensitive data; on FluentCart Pro installs, the Manager shop role also holds the products/edit permission.

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints due to missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to extract sensitive information from the database.

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist.

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens.

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig to map other users' servers.

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens.

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill.

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe, exhausting file descriptors, memory, and goroutines.

FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height, causing writes past the U/V planes.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2. A local attacker can corrupt heap memory via integer wraparound in bitmap size calculation by supplying a crafted v2 persistent cache file with oversized width and height values.

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m). The audio queue buffer size is computed as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU, causing the multiplication to wrap and undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3. A local attacker can corrupt memory by supplying a crafted v3 persistent cache file with large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer.