CVE Vulnerability Catalog

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code.

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without the password, to execute arbitrary commands remotely.

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges and force the creation of an OS account by manipulating the permission column during CSV bulk user registration.

An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dangerous file that is not an official patch.

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions.

The Advanced Woo Labels plugin for WordPress is vulnerable to unauthorized data modification due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to and including 2.51. This allows authenticated attackers with Contributor-level access and above to create AWS labels rendered without proper escaping. The vulnerability was partially patched in version 2.46.

A weakness has been identified in ZongXR SuperMarket 1.0.0.0 affecting the startBuy function of the Instant Buy component. Manipulating the Username argument leads to missing authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be used for attacks. The project was informed but has not responded.

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0 affecting the OrderController.deleteOrder function of the Order Deletion Endpoint. Manipulating the orderId argument results in missing authentication. The attack can be carried out remotely. The exploit has been publicly released and may be used. The project was informed but has not responded.

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected is the function OrderController.addOrder in order/src/main/java/com/supermarket/order/controller/OrderController.java of the save Endpoint component. Manipulation of the userId argument leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used; the project was informed but has not responded.

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin in versions up to and including 3.8.0 is vulnerable to Stored Cross-Site Scripting. A chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser, the Advisor task, and the Advisor dashboard widget allows an unauthenticated attacker to inject arbitrary web scripts into pages that execute when an administrator accesses the WordPress dashboard.

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. Unauthenticated attackers can extract customer PII (names, email addresses, phone numbers, custom form field data) and per-appointment public_token values, which also enables deletion of arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint.

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to disclose every co-booker's private id_token and PII, then use each leaked token to read, overwrite arbitrary appointment meta, or cancel the co-booker's appointment.

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application using the loader.

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the SnapshotPolicy.viewAny/SnapshotPolicy.view function of the /api/v1/snapshots file in the Snapshot Model component. This manipulation causes improper access controls. Remote exploitation is possible. The exploit has been publicly disclosed. Upgrading to version 1.7.2 addresses the issue.

The Newsletter plugin for WordPress up to version 9.3.9 has a vulnerability to insufficiently protected credentials. The public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant.

A vulnerability was found in David-Crty databasement up to 1.7.1, affecting the database-servers API endpoint in app/Http/Requests/Api/V1/RestoreRequest.php. Manipulation of the schema_name argument results in path traversal. The attack can be launched remotely but requires high complexity and is difficult to exploit; the exploit has been made public.

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thread). A Bluetooth-adjacent attacker can crash the daemon by sending a crafted RTP media header with a zero frame count field. Attackers can establish an A2DP source connection with an LC3plus session negotiated against a victim running bluealsad as an A2DP sink and transmit a non-fragmented LC3plus media header with a zero frame count to trigger a SIGFPE in the decoding thread, causing a denial of service on builds compiled with LC3plus support enabled.

Improper initialization in certain ASUS motherboards allows a physically proximate user to read or write arbitrary memory by inserting a specially crafted device. Details are provided in the 'Security Update for Multiple ASUS Motherboards' section of the ASUS Security Advisory.

Use of an externally controlled format string in ASUS Router modules allows a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.