CVE Vulnerability Catalog

The Verified Reviews (Avis Vérifiés) plugin in versions <= 2.4.6 contains an unauthenticated SQL Injection vulnerability. An attacker can inject malicious SQL into database queries.

Traefik (HTTP reverse proxy and load balancer) in versions >= v3.7.0 and <= v3.7.11 has a flaw in the Kubernetes ingress-nginx provider for Ingresses carrying both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. The provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port, a request with a non-numeric or empty port (e.g. 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.

Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route and its controls (Enterprise plan requirement, SSO provider creation via Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth). The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which reports {"has_sso": true, "enforce_sso": true} for domains that were never verified.

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. The flaw allows an attacker to manipulate database queries.

GIS Informatics GisLab Laboratory Management System versions from 1.4.03 before 1.5 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The flaw allows injection of malicious SQL code.

The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.

The Access Control System by Armiya Information Technologies Ltd. Co. contains an open redirect vulnerability to an untrusted site. The issue affects versions before Versiyon 2 and allows faking the source of data.

The GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication. Remote clients can retrieve PTZ information and issue PTZ or raw serial commands.

The GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection. A captured PasswordDigest token can be replayed for subsequent ONVIF operations.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.

In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

The Access Control System by Armiya Information Technologies Ltd. Co. contains an SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions before Versiyon 2.

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.

The miniOrange 2FA WordPress plugin before 6.3.1 and before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input. Any visitor can delete arbitrary options, which can lock every administrator out of the dashboard or deactivate the miniOrange 2FA plugin before 6.3.1 and before 19.3 on the site.

Path traversal vulnerability in Apache FreeMarker template loading mechanism occurs if an attacker can specify an arbitrary malformed locale identifier and the localized lookup configuration setting is enabled (it's enabled by default). This issue affects Apache FreeMarker from 2.2.0 through 2.3.34. Users are recommended to upgrade to version 2.3.35; disabling localized lookup in previous versions also mitigates this. Even in affected versions, files that can be loaded remain restricted by the configured TemplateLoader — FileTemplateLoader prevents traversal outside its baseDir, and other implementations are constrained by the underlying storage mechanism (e.g., class loader or web application context).

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.