CVE Vulnerability Catalog

The SupportCandy plugin for WordPress up to version 3.5.3 is vulnerable to stored XSS via the 'name' parameter. Authenticated attackers with subscriber-level access can inject scripts that execute when a user visits the page.

The Ultimate Member plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.13.1. Unauthenticated attackers can view privacy-restricted member profile field values, including owner-only, members-only, or role-restricted fields, by querying the public wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint is available to all visitors.

The Ivory Search plugin for WordPress up to version 5.5.18 is vulnerable to reflected XSS via the 's' parameter. Unauthenticated attackers can inject scripts that execute when a user accesses a page with search results.

The Jeg Kit for Elementor plugin for WordPress up to version 3.2.19 is vulnerable to stored XSS via comments. Unauthenticated attackers can inject scripts that execute when a user accesses a page with the comment.

Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The Custom Head Scripts feature did not enforce the Manage permission boundary, allowing members with readWrite permission to configure scripts that execute in the session of higher-privileged users.

ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an alternate DOCTYPE. A valid DOCTYPE not ending in ']>' makes the parser consume the rest of the file, so no policy rules are applied and restricted operations become allowed.

OpenAPV before 1.1.1.0 has a heap-based buffer overflow in read_bitstream, which could lead to crashes or potentially arbitrary code execution.

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files and passes them to the ebook-convert program from Calibre. This allows executable code in .recipe or .downloaded_recipe files.

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed monitor tag to endpoints such as monitor-bar and monitor-latency-chart to obtain names, descriptions, status, uptime history and latency.

UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket IDs, which are loaded without an ownership check, to submit or change satisfaction ratings on tickets owned by other customers.

Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemActions.php saves without tag stripping, causing it to execute in the site origin for any visitor viewing the listing.

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obtain the full site configuration, including sensitive settings.

IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoints, which execute in victims' browsers when served from the /public route.

OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/local/lsws/autoupdate/ before extraction, so its install.sh runs as root on the next update.

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference server.

The web management service in affected RouterOS versions contains an integer underflow in HTTP request body handling that is reachable before authentication. An unauthenticated network attacker can exploit a single crafted request to achieve remote code execution as root or cause a denial of service.

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.