| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account. |
| The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline.
Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation. |
| The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once. |
| The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions. |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed. |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account. |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to. |
| The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign. |
| The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event. |
| Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. |
| GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. |
| An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure. |
| An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information. |
| An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings. |
| LaunchConfigurationBaseSerializer.scm_branch has no
validate_scm_branch() leading-dash check, unlike
Project/JobTemplate/JobLaunch serializers. Schedule and
WFJT Node accept --upload-pack=/bin/id as scm_branch.
Currently blocked at runtime by jobs.py:1502 ValueError
check (defense-in-depth), but the API validation gap
means sole reliance on a task-layer guard. Refactoring
that guard away would promote this to RCE. |
| RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limit)) instead of using
args.extend(['-l', limit]) like RunJob. A limit beginning
with - is parsed as an ansible CLI option. Currently
limited to short-circuit flags (--version, --help) since
injected element displaces required pattern positional.
Would escalate if ansible-core ever defaults pattern. |
| Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job.id > 100 %} conditional gating bypass both
the AST check and the test-render (stub has small job.id).
At runtime, the gated branch executes and exceptions write
full tracebacks into notification body, which is POSTed
to attacker-controlled webhook URL. Leaks install paths,
Python version, source line numbers. |
| A server-side request forgery flaw was found in the Ansible Automation Platform
automation-controller email notification backend. The email backend passes the user-supplied SMTP
host and port from a notification template directly to the SMTP client without validating that
the target is not an internal, loopback, link-local, or reserved address. An authenticated user
with organization notification-admin permission can create or modify an email notification
template pointing at an arbitrary internal address, trigger a test, and have the controller task
process open a raw TCP connection to that address. The resulting connection error is reflected
back through the notification record, providing a three-state internal port-scan oracle (open,
closed, filtered) over the control-plane's cluster network, including the in-cluster Kubernetes
API. When a shared organization template holds a stored SMTP password, redirecting the host can
also cause that credential to be transmitted to an attacker-controlled server. |
| An argument-injection flaw was found in the Ansible Automation Platform automation-controller
system-job subsystem. The system-job template launch endpoint stores a user-supplied "days"
variable without running the integer validation defined elsewhere for that field, and the
dispatcher flattens the management-command argument list into a single string with spaces before
the job runner re-splits it, so spaces in the value become additional command-line arguments.
Because system jobs are executed in-process on the control node without the container isolation
applied to all other job types, an authenticated user with superuser privileges can inject
arbitrary arguments — including Python's path option — into the control-plane awx-manage process,
controlling its argument vector and the first entry of its module search path. Full remote code
execution requires an additional import gadget that is not present in the current management
commands, so the demonstrated impact is argument injection with control of the process search
path rather than confirmed code execution. |
| A flaw was found in the Ansible Automation Platform automation-controller. The
WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats
artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore
accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from
the API serializer. Because the column is persisted before Ansible's no_log masking is applied,
a user with only read access to a workflow — or, via a regular-expression lookup that bypasses
the JSON cross-relation filter guard through the world-readable credential-types endpoint, any
authenticated user with no roles — can use the result count as a boolean/count oracle to recover,
character by character, secret values that a playbook author explicitly marked no_log, including
across organizations. |
