CVE Vulnerability Catalog

The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions in all versions up to and including 3.7.0. The issue arises from the `limit` POST parameter being interpolated directly into a SQL query string before being passed to `$wpdb->prepare()`.

In NocoBase prior to version 2.0.39, the checkSQL() validation function was not applied on the sqlCollection:update endpoint, allowing attackers with collection management permissions to inject arbitrary SQL and exfiltrate data.

YesWiki is a wiki system written in PHP that prior to version 4.6.1 contained a SQL injection vulnerability in the bazar module. The $data['id_fiche'] value is directly concatenated into a raw SQL query without any sanitization.

The math.js library for JavaScript and Node.js versions 13.1.0 through 15.1.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.

The @xmldom/xmldom library before versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier fail to validate processing instruction data, allowing an attacker to inject the closing sequence ?> and add arbitrary XML nodes to the resulting document.

Vulnerability in @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier. The package serializes DocumentType fields (internalSubset, publicId, systemId) without proper escaping, which can lead to premature termination of the DOCTYPE declaration and injection of arbitrary markup.

In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application.

The vulnerability in the xmldom library allows an attacker to inject arbitrary XML nodes into serialized output via controlled comment content. Lack of validation of comment-breaking sequences enables premature comment termination and insertion of malicious XML code.

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module did not validate the AssertionConsumerServiceURL value from incoming SAML AuthnRequest messages, allowing an attacker to send the SAML response to a controlled URL.

Admidio is an open-source user management solution. In versions prior to 5.0.9, the SAML Identity Provider implementation discards the return value of its validateSignature() method, leading to the processing of unsigned or invalidly-signed SAML requests identically to properly signed ones.

Admidio is an open-source user management solution. Prior to version 5.0.9, a logic error in Admidio's two-factor authentication reset inverts the authorization check, allowing non-admin users to remove other users' TOTP configurations, including administrators.

In versions prior to 2.0.39 of the NocoBase platform, the queryParentSQL() function in the database package allows attackers to inject arbitrary SQL through malicious primary keys. This issue has been patched in version 2.0.39.

In CI4MS, from version 0.26.0.0 to before version 0.31.7.0, the theme upload feature allows authenticated backend users with theme-upload permission to achieve remote code execution (RCE) by uploading crafted ZIP files. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering.

In OpenEXR library versions 3.0.0 to 3.2.9, 3.3.0 to 3.3.11, and 3.4.0 to 3.4.11, an integer overflow in ImageChannel::resize leads to a heap out-of-bounds write via the OpenEXRUtil public API.

The Spring Cloud Config Server is susceptible to time-of-check-time-of-use (TOCTOU) attacks due to the use of a base directory for cloning Git repositories.

A vulnerability in Spring Cloud Config allows a client to craft a request to the config server, potentially exposing secrets from unintended GCP projects when Google Secrets Manager is used as a backend.

A flaw has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7, allowing manipulation of the ADMIN_KEY argument, leading to hard-coded credentials. The attack can be carried out remotely.

OpenClaw before version 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations.

OpenClaw before 2026.4.22 contains a server-side request forgery (SSRF) vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources.

OpenClaw before version 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.