CVE Vulnerability Catalog

A flaw was found in Ansible Lightspeed related to insufficient session expiration. A remote attacker can maintain persistent access to the Ansible Lightspeed instance if they exfiltrate a valid OAuth access token before a user logs out. The application fails to invalidate the token on the backend, leaving it valid until its natural expiration.

The Form Builder CP WordPress plugin before version 1.2.47 does not properly sanitize a form configuration value before storing and using it in a client-side script. Authenticated users with Editor-level access and above can perform Stored Cross-Site Scripting attacks against any visitor of a page rendering the affected form, even when the `unfiltered_html` capability is disallowed (e.g., in a multisite network).

The WP Go Maps WordPress plugin before version 10.0.10 does not filter approval state in its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that have not yet been approved by an administrator, including any PII in address and description fields and geographic coordinates.

The WP Go Maps WordPress plugin before version 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.

A vulnerability in Yealink SIP-T46U 108.86.0.118. The mod_webd.TFTPUploadIperf function in /api/inner/tftpuploadiperf of the Web FastCGI Service component allows command injection via ip/port arguments. Local network attack, exploit public. Fixed in version 108.87.0.23.

A vulnerability has been found in Yealink SIP-T46U version 108.86.0.118, allowing command injection in the mod_diagnose.CommandShellByType function of /api/diagnosis/start. The attack can be launched remotely by manipulating the Time argument. The issue is fixed in version 108.87.0.23.

In the Duktape library (up to version 2.99.99), a weakness was found in the file duk_api_bytecode.c. Manipulation of the count_instr argument can lead to memory corruption. The attack requires local access and an exploit has been published.

Vulnerability in hcengineering Huly Platform up to version 0.7.0. The getAccountInfo function in server/account/src/operations.ts (User Information Handler) has improper authorization. The attack can be launched remotely and the exploit is publicly available.

In hcengineering Huly Platform up to version 0.7.0, the function getMailboxSecret in file server/account/src/operations.ts (RPC Interface component) has improper access controls. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability was detected in universal-tool-calling-protocol python-utcp version 1.1.0 in the utcp-gql/utcp-websocket component. Manipulation leads to server-side request forgery (SSRF). The attack can be initiated remotely. The exploit is public. The vendor did not respond.

RubyLouvre avalon up to version 2.2.10 has a vulnerability in src/filters/index.js allowing remote manipulation of object prototype attributes. An attacker can remotely modify prototype attributes, leading to uncontrolled object modification.

jsonata-js jsonata up to version 2.2.0 has a vulnerability in the createFrame function of src/jsonata.js, allowing remote manipulation of object prototype attributes. An attacker can remotely modify prototype attributes, leading to uncontrolled object modification.

In medkey-org medkey up to commit fc09b7ba9441ff590b72d428d5380834216b09ed, a vulnerability was found in the actionGetPatientById function of PatientController.php in the HTTP REST API component. Manipulation of the ID argument leads to improper control of resource identifiers. The attack can be performed remotely. The exploit is public. The vendor did not respond.

SQL Injection vulnerability in Grit42 Grit up to version 0.11.0. The issue affects the Grit::Assays::DataTableEntity function in the data_table_entity.rb file. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was found in HKUDS AI-Trader up to commit 74caf996f78dcc0c657df8365c8544678a16e215. An unknown part of the file /api/research/agents.csv (Research Export component) allows information disclosure through manipulation. Remote exploitation is possible, and the exploit has been made public. The vendor confirms that research export endpoints now require an authenticated agent with the research_exports capability. A patch named 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 is available.

A vulnerability was found in IObit Malware Fighter up to version 13.2.0 related to an unknown functionality of the DLL Handler component. Manipulation of this component causes permission issues. The attack requires local access. An exploit has been published.

In the Genspark AI Workspace App version 2.8.4 on Android, a vulnerability was found in the component ai.mainfunc.genspark. Manipulation leads to improper authorization in the handler for a custom URL scheme. The attack requires a local environment.

In the Moovit Bus & Public Transit App version 1.18 on Android, a vulnerability was found in the component com.tranzmate. Manipulation leads to improper authorization in the handler for a custom URL scheme. The attack requires local access and an exploit has been published.

SQL Injection vulnerability in Grit42 Grit up to version 0.11.0. The issue affects unknown functionality in the grit_entity_controller.rb file of the GritEntityController component. The attack can be carried out remotely, and the exploit is publicly available.

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path, allowing a local or network-adjacent attacker to recover the plaintext password of a target account by measuring response-timing differences.