CVE Vulnerability Catalog

NamelessMC, website software for Minecraft servers, in versions 2.2.4 and prior, does not validate the state parameter server-side during OAuth callback. This allows an attacker to capture a valid OAuth callback URL and swap the victim's session to the attacker-linked account (OAuth login CSRF / session swapping).

Missing authorization in the Elementor Website Builder plugin for WordPress (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.

Path traversal vulnerability in Gleam's dependency management (versions 0.18.0-rc1 through 1.17.0) allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys are used without validation to construct paths, allowing ../ sequences to escape the intended directory.

A symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. File collection helpers use follow_links(true) when walking publishable directories, and paths are added to the archive without verifying that the resolved target remains within the project root.

In RUGGEDCOM RST2428P (6GK6242-6PA00) before version V4.0, the application stores sensitive information in the browser cache when an authenticated user modifies specific configurations. This allows an authenticated attacker to access sensitive data stored in the browser.

A stack-based buffer overflow in export_language.cgi on VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request with a controlled Content-Length value.

Path traversal vulnerability in Gleam's custom documentation pages handling (versions 1.16.0 through 1.17.0) allows arbitrary file read and write outside the intended documentation output directory. The documentation.pages[].path and .source fields are used without sufficient validation.

A Reflected XSS vulnerability was found in NamelessMC 2.2.4 in the id parameter of the `/index.php?route=/queries/user/` endpoint. The application reflects user input without proper sanitization, allowing an attacker to inject malicious JavaScript code.

The Progress Planner plugin for WordPress up to version 1.9.0 contains a stored XSS vulnerability due to improper input neutralization during page generation.

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM from n/a through 1.2.2.

Dräger Infinity Delta, Delta XL, and Kappa patient monitors disclose sensitive information. An unauthenticated network attacker can access log files over a network connection, retrieving device internals, location information, and wired network configuration.

The D.Launcher 2 component of the Slovak eID client ecosystem contains an Improper URL Handler Processing vulnerability. Custom URL handlers can be exploited to initiate full NTLM authentication or SMB connection to attacker infrastructure and to conduct SSRF attacks. User interaction is required.

The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting in all versions up to and including 3.1. Insufficient input sanitization and output escaping in the 'data-image-title' parameter allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages.

Apache Calcite from version 1.5.0 before 1.42 has an Unsafe Reflection vulnerability. Externally-controlled input can be used to select classes or code, allowing remote code execution.

An improper authorization vulnerability has been identified in Apache Kafka. The CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation as documented. This can result in misconfigured ACLs and unintended security postures.

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL with JavaScript in the locale parameter and send it to a victim, executing the script in their browser.

Yandex Database prior to 25.3.1.25 has an LDAP filter injection vulnerability. A remote attacker with valid LDAP credentials can bypass group membership checks, leading to unauthorized database access.

Missing authorization in the Thim Core plugin (versions up to 2.3.3) allows exploiting incorrectly configured access control security levels.

Missing Authorization vulnerability in Anton Shevchuk Constructor allows accessing functionality not properly constrained by ACLs. This affects versions from n/a through 1.6.5.

Missing Authorization vulnerability in Printeers Printeers Print & Ship allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Printeers Print & Ship from n/a through 1.17.0.