CVE Vulnerability Catalog

The JetFormBuilder plugin (Crocoblock) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. The issue affects versions up to and including 3.6.7.1.

A vulnerability was detected in loguru 0.7.3 in the AnsiParser.feed function of loguru/_colorizer.py, part of the ANSI Color-Markup Parser component. Manipulating input results in inefficient regular expression complexity (ReDoS), and the attack can be carried out remotely. The exploit is publicly available, and the vendor did not respond to the disclosure.

The MapPress WordPress plugin before 2.97.15 does not restrict which users' data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.

A security vulnerability has been detected in Presenton up to 0.9.11-beta. It affects an unknown part of the /app_data file in the Desktop Authentication Middleware component and leads to information disclosure. The attack can be launched remotely, and a public exploit is already available.

imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow in the lossless JPEG Define Huffman Table parser in decode_jpegsof3(). A crafted file can overflow the 32-entry HufVal and HufSz stack arrays and crash the calling process.

imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size(). An attacker can supply a crafted CCITT Group 4 stream lacking EOFB, causing the calling process to hang and consume full CPU.

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. A network-positioned attacker can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. An attacker can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags.

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. An SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory can execute scripts against visitors and higher-privileged administrators.

FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows leaking heap memory into decoded pixels via short packed-BGR bitstreams. A crafted Huffyuv BGR24/BGRA video can cause decode_slice() to add uninitialized s->temp[0] bytes into output frames.

FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. A crafted type-0 CDXL file can expose stack bytes and pointer fragments in the BGR24 output.

FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks heap memory when decoding truncated 1-bit and 4-bit paletted Sun Raster images. A crafted truncated Sun Raster file can cause the uncleared temporary bitmap to be expanded into PAL8 pixels, exposing stale heap contents.

FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder. Attackers can craft a PCX image whose RLE data ends early, causing pcx_decode_frame() to copy uninitialized av_malloc() buffer contents into visible decoded pixels.

FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.

A security flaw was discovered in YznCMS up to version 2.2.0 in the Backend function of app/admin/controller/auth/Group.php (Auth Group Handler component). Manipulation results in improper privilege management. The attack can be initiated remotely, and upgrading to version 2.2.1 fixes the issue.

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.