CVE Vulnerability Catalog

The security fix for CVE-2025-66518 in Apache Kyuubi is incomplete. Any client with access to the Kyuubi server via frontend protocols can bypass the server-side config kyuubi.session.local.dir.allowlist using unprefixed Spark config aliases. This affects versions from 1.6.0 before 1.12.0.

Some Hikvision networking products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can send crafted packets containing malicious commands, leading to arbitrary command execution.

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base) in the get_ruvelement_from_berval() function. A remote unauthenticated attacker can send a crafted StartNSDS50ReplicationRequest with a replica ID field containing more than 16 digit characters, causing a crash of the LDAP server.

A flaw was found in 389 Directory Server where an unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV operation. Because the query runs with elevated privileges, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS) where processing Kubernetes Deployments replaces identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name, labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration, exposes its data and configuration endpoint without any authentication and permissive CORS. An unauthenticated attacker with network access can read live process values and server configuration.

ANDRITZ HIPASE-250 stores and transmits user passwords in a reversible format instead of a one-way hash. This allows an attacker to recover all stored passwords by reading the credential store or capturing network traffic.

The Realtyna Organic IDX plugin for WordPress up to version 5.3.0 is vulnerable to arbitrary file upload due to missing file validation and insufficient authorization. Authenticated attackers with subscriber-level access can upload arbitrary files, potentially leading to remote code execution.

The Product Feed Manager For WooCommerce WordPress plugin before version 7.6.1 does not properly sanitize and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

The Geeky Bot WordPress plugin before version 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.

The FlxWoo WordPress plugin before version 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid. This allows unauthenticated attackers to complete WooCommerce orders without paying.

The Demi WordPress plugin before version 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection. This allows unauthenticated attackers to download complete backups including the site database and its user password hashes.

The GiveWP WordPress plugin before version 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records. This allows unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

The Frontend Admin by DynamiApps WordPress plugin before version 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the plugin's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that is subsequently executed, allowing arbitrary PHP code to run on the server. On a multisite network, a non-super subsite Administrator can reach host-level code execution.

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection triggered when an administrator later reviews the stored data. With a suitable gadget chain, this could lead to remote code execution.

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.