CVE Vulnerability Catalog

TeamViewer DEX Platform (On-Premises) prior to version 9.2 has a broken access control vulnerability. Some backend API endpoints do not enforce authorization correctly, allowing an authenticated low-privileged user to perform actions and access resources intended for higher-privileged roles.

The FluentCRM plugin for WordPress up to version 2.9.87 is vulnerable to blind SSRF via the 'SubscribeURL' parameter. Unauthenticated attackers can make requests to arbitrary locations from the application, allowing them to query and modify internal services. Exploitation requires that the SES bounce handling key has never been stored (default configuration).

The Slider by Soliloquy – Responsive Image Slider for WordPress plugin up to version 2.8.1 is vulnerable to sensitive information exposure via map_meta_cap. Authenticated attackers with subscriber-level access can extract draft slider metadata including unpublished media URLs, captions, and slider configuration.

The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3 due to missing or incorrect nonce validation on the save_widget_context_settings function. This allows unauthenticated attackers to modify widget visibility context settings via a forged POST request to /wp-admin/widgets.php, provided they can trick a site administrator into performing an action such as clicking a link.

A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes via crafted PTP messages.

The Draft List plugin for WordPress up to version 2.6.3 has a Stored XSS vulnerability via draft post titles. Authenticated attackers with author-level access can inject scripts that execute for users without edit capabilities.

The KIA Subtitle plugin for WordPress up to version 4.0.1 is vulnerable to Stored Cross-Site Scripting via the `before` and `after` attributes of the `the-subtitle` shortcode, due to insufficient input sanitization and output escaping.

The Location Weather plugin for WordPress up to version 3.0.2 is vulnerable to unauthorized data modification due to missing capability checks in the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions, allowing authenticated attackers with Contributor-level access or above to disable all weather blocks and purge all weather cache transients.

The CBX 5 Star Rating & Review plugin for WordPress versions up to 1.0.7 is vulnerable to Reflected XSS via the 'page' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute if an administrator clicks a link.

The Alfie – Feed Plugin for WordPress up to version 1.2.1 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the alfie_manage() function handling feed deletion via the 'delete' GET parameter. Unauthenticated attackers can delete arbitrary plugin feed data by tricking an administrator into clicking a link.

An information disclosure vulnerability was found in ZTE MU5250. Due to improper configuration of the access control mechanism, attackers can obtain information without authorization, causing the risk of information disclosure.

The WP Blockade plugin for WordPress up to version 0.9.14 is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in the render_shortcode_preview() function, due to insufficient input sanitization and output escaping. The endpoint requires authentication (Subscriber-level or above) and lacks nonce verification or capability checks.

The FastX theme for WordPress up to version 1.0.2 lacks capability checks in the 'ultp_install_callback' and 'ultp_activate_callback' functions, allowing authenticated attackers with subscriber-level access to install and activate the PostX plugin.

In Mothra, the software respects a default value given by a website for HTML file upload forms. An attacker can craft a website with a malicious default file path and conceal this form element.

For certain crafted inputs, an ed25519.PrivateKey was created by casting malformed wire bytes, leading to a panic when used.

SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can panic when a client presents a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

In SSH, when an authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded. This could drop certificate restrictions like force-command after a second factor. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

An authenticated SSH client that repeatedly opened channels rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Concrete CMS 9 before version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) in the approveVersion() controller. An attacker can exploit this vulnerability to perform unauthorized actions on behalf of an administrator.

IDOR vulnerability in Concrete CMS 9.5.0 and below allows unauthenticated attackers to vote in restricted surveys via a public endpoint.