CVE Vulnerability Catalog

The Iptanus File Upload WordPress plugin before 5.1.7 has a TOCTOU race condition when duplicatepolicy is set to 'maintain both', allowing authenticated attackers to overwrite other users' files.

In OpenStack Ironic before version 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials).

Vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. An unknown function in the file /index.php allows XSS attack via manipulation of the action argument. The attack can be carried out remotely.

CodeAstro Student Attendance Management System 1.0 is vulnerable to SQL injection in the file /attendance-php/Admin/createStudents.php via the admissionNumber argument. The attack can be performed remotely, and the exploit is public.

The Meow Gallery plugin for WordPress up to version 5.4.4 is vulnerable to unauthorized data modification via the REST API endpoint /wp-json/meow-gallery/v1/save_shortcode due to a missing capability check. Authenticated attackers with Author-level access can create or overwrite gallery records by supplying a controlled id value.

Stored Cross-Site Scripting (XSS) vulnerability in the Canvas plugin for WordPress up to version 2.5.2. The issue is due to insufficient input sanitization and output escaping in the 'tag' parameter. Authenticated attackers with contributor-level access and above can inject arbitrary scripts.

The Page Builder: Pagelayer WordPress plugin up to version 2.0.9 has a Stored XSS vulnerability via the Anchor block due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts.

Incorrect Authorization vulnerability in Page Builder: Pagelayer for WordPress up to version 2.0.9. The issue involves the pagelayer_save_content AJAX handler allowing users with post-edit capability to persist pagelayer_contact_templates metadata, and the unauthenticated pagelayer_contact_submit endpoint consumes that metadata without proper context checks. Authenticated attackers with contributor-level access and above can configure contact form templates usable by unauthenticated users.

Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery plugin for WordPress up to version 3.1.31. The issue is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function and failure to escape the attribute key in foogallery_build_container_attributes_safe(). Authenticated attackers with contributor-level access and above can inject arbitrary scripts.

In the libreport tool used in ABRT (Automatic Bug Reporting Tool), a content injection vulnerability was found. The post-create event script reads the systemd journal and writes results to files in the dump directory without sanitizing control characters. A local user can inject arbitrary content by embedding newline characters in syslog messages.

The LWS Optimize plugin for WordPress up to version 3.3.19 is vulnerable to arbitrary file read. The combine_current_css() function trusts href values from <link> tags in page HTML and converts same-site URLs to absolute filesystem paths before reading them without verifying that the path stays within ABSPATH or has a .css extension. This allows authenticated attackers with Editor-level access and above to read arbitrary files.

Allegra contains a Cross-Site Scripting (XSS) vulnerability in the downloadAttachment method, allowing authentication bypass. The issue results from lack of input validation, enabling arbitrary script injection. User interaction is required (visiting a malicious page or opening a file).

A directory traversal vulnerability in Allegra's exportReport method. Allows remote disclosure of sensitive information. Authentication required.

An authorization flaw in MISP's object add/edit handling allows an authenticated user with object editing permissions to assign an object or attributes to a sharing group they are not authorized to use. The sharing group validation was performed on the wrong data structure, bypassing the check.

Vulnerability in Capgo before version 12.128.2. When users replace or remove profile images, old files are not deleted from backend storage. Attackers can access orphaned images via previously generated URLs.

OpenClaw before version 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted host to send authentication material to untrusted endpoints.

Vulnerability in OpenClaw before 2026.5.6 allows a configuration enforcement bypass in Feishu dynamic-agent bindings. Authenticated senders can create or update bindings without honoring configured config-write controls, enabling unauthorized binding modifications.

OpenClaw before version 2026.4.22 contains a webhook secret revocation bypass vulnerability. Old Slack and Zalo webhook secrets remain active after secrets.reload, allowing attackers to deliver webhook events using previous credentials.

OpenClaw before version 2026.5.2 contains a credential exposure vulnerability in message.action forwarding, allowing remote attackers to intercept Gateway tokens and action payloads.

OpenClaw before 2026.4.26 contains an information disclosure vulnerability in sandboxed session spawning that exposes the real workspace path to child prompts. Attackers can exploit this by spawning child sessions from sandboxed parents to reveal host workspace location or related memory context to child models.