CVE Vulnerability Catalog

A flaw was found in HaschekSolutions PictShare up to 3.7.1 in the architect function of src/inc/core.php within the File Upload component. The manipulation causes a race condition, and the attack can be initiated remotely. Attack complexity is rated high and exploitability difficult; the exploit has been published and may be used.

A vulnerability was detected in libimobiledevice up to 1.4.0 in the webinspector_receive_with_timeout function of src/webinspector.c within the Web Inspector component. The manipulation results in a heap-based buffer overflow, and the attack can be launched remotely. The exploit is public and may be used; the vendor did not respond.

Frappe Builder before 1.36.1 contains an SSRF vulnerability in builder/api.py where assert_not_private_url() validates only the initial hostname before requests.get(url) follows redirects with no IP pinning. An authenticated attacker can call the convert_to_webp endpoint (lacking a permission decorator) with a URL redirecting to internal targets such as cloud metadata services, enabling SSRF, internal port scanning, or request-hang DoS due to the missing timeout.

Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and turning the site into a free LLM proxy.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Logsign SIEM affects versions from 6.4.120 before 6.4.122. It may allow access to files outside the intended directory.

The Mendix SAML module (Mendix 9, 10, and 11 compatible versions before V3.6.29 and V4.2.4 respectively) does not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML response.

In libimobiledevice up to 1.4.0, the function afc_get_device_info_key in src/afc.c (Device Info Handler component) has a flaw where manipulation of the Value argument results in memory corruption. The attack requires local access, and a public exploit has been released. The vendor did not respond to the disclosure.

In libimobiledevice up to 1.4.0, an unknown part of src/afc.c (AFC component) contains a heap-based buffer overflow. The attack can be executed remotely, and a public exploit is available. The vendor did not respond to the disclosure.

The B Slider plugin (through 2.2.2) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.

The APIExperts Square for WooCommerce (woosquare) plugin through version 4.7.5 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The APIExperts Square for WooCommerce (woosquare) plugin through version 4.7.5 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Panorama Viewer – 360 Degree Image + Video Viewer plugin through version 1.8.3 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Advanced Post Block - Post Grid for WordPress block editor plugin through version 2.5.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Geo Mashup plugin through version 1.13.22 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Geo Mashup plugin through version 1.13.22 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Lazy Load for Videos plugin through version 2.18.11 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Better Post & Filter Widgets for Elementor plugin through version 1.9.1 contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation.

The Contact Form by Supsystic plugin through version 1.10.7 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Media Library Assistant plugin through version 3.42 contains an insertion of sensitive information into sent data vulnerability that allows retrieval of embedded sensitive data.

The JetSmartFilters plugin by Crocoblock contains a Stored XSS vulnerability caused by improper neutralization of input during web page generation. The issue affects versions from n/a through 3.8.6.1.