summary: Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.

title: Wolfssl security vulnerability


default_status: unaffected

product: Mediawiki - SecurePoll Extension

vendor: The Wikimedia Foundation

status: affected

version: master

ecosystem: software/application

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Deferred

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

title: The Wikimedia Foundation Mediawiki - Securepoll Extension security vulnerability


product: ChurchCRM

metric_type: Primary

severity: high

severity: low

part: a

product: churchcrm

vendor: churchcrm

status: Modified

summary: A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.


product: LibreWolf

status: unaffected

ecosystem: windows/system

summary: A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of the file assets/setup.nsi of the component Installer. Such manipulation leads to uncontrolled search path. The attack must be carried out locally. Attacks of this nature are highly complex. The exploitability is reported as difficult. Upgrading to version 144.0-1 mitigates this issue. The name of the patch is dd10e31dd873e9cb309fad8aed921d45bf905a55. It is suggested to upgrade the affected component.


product: CMS

status: Analyzed

summary: A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


ecosystem: operating-system

severity: critical

part: o

summary: A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


summary: A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: Vvveb

vendor: givanz

product: vvveb

vendor: vvveb

summary: A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue.


product: AFFiNE

vendor: toeverything

summary: A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.


product: Community Edition

vendor: LogicalDOC

product: logicaldoc

vendor: logicaldoc

summary: A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.


product: bftpd

summary: A weakness has been identified in bftpd up to 6.2. Impacted is the function expand_groups of the file options.c of the component Configuration File Handler. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack on the local host. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.


product: Document Management System

vendor: Excellent Infotek

summary: Document Management System developed by Excellent Infotek has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

title: Excellent Infotek Document Management System security vulnerability


product: EasyFlow .NET

vendor: Digiwin

version_type: custom

product: EasyFlow AiNet

summary: EasyFlow .NET and EasyFlow AiNet, developed by Digiwin, has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to obtain database administrator credentials via a specific functionality.

title: Digiwin Easyflow .Net security vulnerability


product: EduAsist

product: eduasist

vendor: eduasist

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KNOWHY Advanced Technology Trading Ltd. Co. EduAsist allows Reflected XSS. This issue affects EduAsist: before v2.1.

title: Eduasist security vulnerability


product: Chatbot

ecosystem: javascript/npm

product: chatbot

summary: Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.


known_ransomware_campaign_use: Unknown

notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 ; https://github.com/react-native-community/cli/pull/2735 ; https://nvd.nist.gov/vuln/detail/CVE-2025-11953

product: CLI

required_action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

vendor_project: React Native Community

vulnerability_name: React Native Community CLI OS Command Injection Vulnerability

author: Codex

content_markdown:
CVE-2025-11953 is a critical command-injection issue in the Metro
Development Server started by React Native Community CLI. Vulnerable
development servers bind to external interfaces by default and expose an
`/open-url` path that can pass attacker-controlled input to the `open` package.
An unauthenticated network attacker can send a POST request to the dev server
and run arbitrary executables; on Windows, the attacker can execute shell
commands with controlled arguments.

This recipe is for repository owners who control React Native package pins,
dev-server scripts, devcontainer/Codespaces exposure, CI workbenches, or agent
workspaces. A mergeable fix does more than bump a dependency: it proves whether
Metro is reachable beyond a single trusted local developer, removes exposed
defaults, and documents credential cleanup when an affected server was online.

## When to use it

- A repository installs, vendors, builds, or documents React Native Community
  CLI or `@react-native-community/cli-server-api` in a potentially affected
  range.
- Metro can be started by scripts, mobile run commands, devcontainers,
  Codespaces, remote IDEs, CI workbenches, or agent workspaces.
- Metro may bind beyond loopback, publish a Docker/devcontainer port, use a
  tunnel, or run on Windows/shared workstations with reachable secrets.
- You need a bounded PR or triage note that upgrades the CLI and proves Metro
  dev servers are loopback-only by default.

## Inputs

- `package.json`, lockfiles, React Native scripts, Metro config, mobile
  platform launchers, Docker/devcontainer/Codespaces config, CI jobs, SBOMs,
  generated dependency reports, and runbooks.
- Host binding defaults, forwarded ports, wrapper routes, `/open-url` handling,
  Windows/macOS launcher behavior, secret-bearing environment, and credential
  rotation ownership.
- Available package install, lockfile integrity, policy tests, mobile smoke
  tests, devcontainer render/build, lint/typecheck, SBOM, and security scan
  commands.

## Affected versions

- **Affected package:** `@react-native-community/cli-server-api`
- **Common bundle:** `@react-native-community/cli`
- **GitHub reviewed ranges:** `18.0.0`; `19.0.0-alpha.0` through versions before
  `19.1.2`; and `20.0.0-alpha.0` through versions before `20.0.0`, for both
  `@react-native-community/cli` and `@react-native-community/cli-server-api`.
- **Broader CNA scope:** JFrog reports
  `@react-native-community/cli-server-api` from `4.8.0` through versions before
  `20.0.0`. For an older line not covered by the reviewed backport ranges, do
  not infer safety; prove the vulnerable Metro path is absent or move to a
  fixed compatible line.
- **Fixed:** `18.0.1`, `19.1.2`, or `20.0.0` for the corresponding maintained
  line. Later compatible releases are also acceptable when they retain the fix.
- **CISA KEV:** added 2026-02-05 with required action due 2026-02-26.
  Rechecked against the CISA KEV JSON on 2026-08-21; those dates and the
  `18.0.1` / `19.1.2` / `20.0.0` fixed lines are unchanged.
- **Affected runtime:** Metro Development Server launched by React Native
  Community CLI commands such as `npm start`, `npx react-native start`,
  `npx react-native run-android`, `npx react-native run-ios`,
  `npx react-native run-windows`, or matching package-manager scripts.

Not every React Native repository is exposed. Projects that use a framework or
toolchain that does not start Metro through the vulnerable Community CLI path
should produce a documented `TRIAGE.md` or suppression note instead of a
speculative dependency PR.

## Indicator-of-exposure

- The repository resolves `@react-native-community/cli-server-api` or
  `@react-native-community/cli` in the vulnerable range.
- Scripts, runbooks, devcontainers, Codespaces configs, CI jobs, desktop
  launchers, or agent workbenches start Metro with `npm start`,
  `react-native start`, `run-android`, `run-ios`, `run-windows`,
  `run-macos`, or wrapper commands.
- Metro binds beyond loopback, publishes a Docker/devcontainer port, exposes a
  remote IDE or Codespaces forwarded port, uses a tunnel, runs on a shared LAN
  workstation, or is reachable from browser-agent or mobile-device networks.
- The dev-server process can read `.env` files, mobile signing keys, package
  tokens, repository tokens, cloud credentials, emulator/device data, SSH keys,
  local source trees, generated bundles, or internal network services.
- The repository contains platform-specific React Native Windows/macOS launch
  paths, where Windows exposure is especially dangerous because shell command
  arguments can be controlled.

Quick checks:

```bash
rg -n "@react-native-community/cli|cli-server-api|react-native (start|run-android|run-ios|run-windows|run-macos)|metro|--host|0\\.0\\.0\\.0|127\\.0\\.0\\.1|open-url|devcontainer|forwardPorts|ports:" .
npm ls @react-native-community/cli @react-native-community/cli-server-api
pnpm why @react-native-community/cli @react-native-community/cli-server-api
yarn why @react-native-community/cli @react-native-community/cli-server-api
```

Windows:

```powershell
rg -n "@react-native-community/cli|cli-server-api|react-native (start|run-android|run-ios|run-windows|run-macos)|metro|--host|0\.0\.0\.0|127\.0\.0\.1|open-url|devcontainer|forwardPorts|ports:" .
npm ls @react-native-community/cli @react-native-community/cli-server-api
pnpm why @react-native-community/cli @react-native-community/cli-server-api
yarn why @react-native-community/cli @react-native-community/cli-server-api
```

Do not validate exposure by POSTing to `/open-url`, launching executables,
spawning shell commands, opening URLs against a real Metro server, or using a
developer workspace with live secrets.

## Remediation strategy

- Upgrade every controlled `@react-native-community/cli-server-api`,
  `@react-native-community/cli`, React Native CLI bundle, package lock,
  devcontainer image, CI cache, generated dependency report, and SBOM to
  `18.0.1`, `19.1.2`, `20.0.0`, or a later compatible release that retains
  the fix.
- Bind Metro to loopback by default. Add `--host 127.0.0.1` to local scripts
  and remove accidental `0.0.0.0`, Docker published port, devcontainer,
  Codespaces, tunnel, and LAN exposure defaults.
- Keep development servers out of secret-bearing release, deploy, package
  publish, and signing jobs. Run Metro in a low-privilege development profile
  with minimal environment variables and no broad home-directory mounts.
- If this repository owns wrappers around Metro, reject or remove any route
  that forwards untrusted URL values into `open`, shell launchers,
  `child_process.exec`, `cmd /c`, PowerShell, or OS-specific opener commands.
- For React Native Windows and shared workstations, treat exposure as higher
  risk and require explicit proof that Metro is loopback-only after the fix.
- If a vulnerable Metro server was reachable by untrusted clients, rotate
  mobile signing credentials, package tokens, repository tokens, cloud keys,
  model-provider keys, and other long-lived secrets that were present in the
  process environment.

## The prompt

~~~markdown
Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2025-11953, a critical known-exploited command
injection vulnerability in React Native Community CLI / Metro Development
Server, also known as Metro4Shell. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades every affected React Native
  Community CLI package, hardens Metro dev-server exposure, adds safe
  regression checks, refreshes generated artifacts, and documents operator
  credential cleanup, or
- TRIAGE.md if this repository does not control an affected React Native
  Community CLI package, Metro launch path, devcontainer/workbench exposure,
  image, script, lockfile, or safe containment path.

## Rules

- Scope only CVE-2025-11953 and directly related React Native Community CLI,
  Metro dev-server, `/open-url`, host binding, devcontainer, CI/workbench,
  script, lockfile, logging, and credential-boundary changes.
- Treat `.env` files, source code, mobile signing keys, emulator/device data,
  package tokens, repository tokens, cloud credentials, model-provider keys,
  SSH keys, browser profiles, command output, and logs as sensitive.
- Do not POST to `/open-url`, launch executables, spawn shells, execute
  proof-of-concept commands, or test against a real secret-bearing developer
  workspace.
- Do not remove tests, mobile platform support, signing checks, authentication,
  or CI gates just to silence the advisory.
- Do not preserve `0.0.0.0`, forwarded ports, tunnels, shared workbench
  ingress, or public Metro access as default behavior.
- Do not auto-merge.

## Steps

1. Inventory every JavaScript/TypeScript workspace, package manifest,
   lockfile, React Native CLI wrapper, Metro config, Dockerfile, devcontainer,
   Codespaces config, CI job, mobile platform script, generated dependency
   report, SBOM, and runbook controlled by this repository.
2. Resolve every `@react-native-community/cli-server-api` and
   `@react-native-community/cli` version. A target is vulnerable if it resolves
   to `18.0.0`, the `19.0.0-alpha.0` through `<19.1.2` range, or the
   `20.0.0-alpha.0` through `<20.0.0` range, including transitive CLI bundles,
   global installs, image layers, and unpinned `npx` launch paths. For
   `cli-server-api >=4.8.0` on an older line, preserve the CNA's broader scope:
   prove the vulnerable Metro path is absent or treat the target as affected.
3. Inventory every Metro launch path: `npm start`, `react-native start`,
   `run-android`, `run-ios`, `run-windows`, `run-macos`, package-manager
   scripts, IDE launchers, devcontainer tasks, CI workbenches, and agent
   workspace commands.
4. Classify each Metro runtime boundary: single-user loopback, Windows local
   developer, emulator/device-only workflow, devcontainer forwarded port,
   Codespaces, LAN/shared workstation, remote IDE, browser-agent workbench,
   tunnel, CI runner, or internet/network-exposed service.
5. Determine which credentials and files the Metro process can reach:
   `.env` files, mobile signing keys, package tokens, cloud credentials,
   repository tokens, SSH agents, emulator/device data, browser profiles,
   generated bundles, local source, Docker sockets, and internal services.
6. If the repository only uses React Native through a framework that does not
   start Metro through the vulnerable Community CLI path, stop with
   `TRIAGE.md` listing checked files, resolved versions, why the vulnerable
   runtime is absent, owner, and recheck command.
7. Upgrade controlled package references to `@react-native-community/cli` and
   `@react-native-community/cli-server-api` `18.0.1`, `19.1.2`, `20.0.0`, or
   a later fixed line this repository can consume. Refresh package locks, package-manager
   metadata, SBOMs, generated dependency reports, image layers, devcontainer
   artifacts, and docs.
8. Harden Metro exposure:
   - add `--host 127.0.0.1` or equivalent loopback binding to default scripts;
   - remove default `0.0.0.0`, Docker published port, devcontainer forwarded
     port, Codespaces public visibility, tunnel, LAN, and remote IDE exposure;
   - require an explicit reviewed exception for any non-loopback Metro server;
   - keep Metro out of release, publish, deploy, and signing jobs.
9. If this repository owns a Metro wrapper, route, or platform extension,
   ensure untrusted URL values are not passed to `open`, shell launchers,
   `child_process.exec`, `cmd /c`, PowerShell, or OS opener commands. Prefer
   strict URL allow-lists and structured APIs that do not invoke a shell.
10. Add safe regression checks:
    - dependency resolution rejects vulnerable CLI/server-api versions;
    - scripts/config default Metro to loopback;
    - config tests fail on public devcontainer/Codespaces/CI exposure unless a
      reviewed exception file exists;
    - wrapper tests use inert strings to prove disallowed URL shapes are
      rejected before any opener path;
    - logs do not include secrets, full environment values, command output, or
      sensitive local paths.
11. Add a PR body section named `CVE-2025-11953 operator actions` that states:
    - package versions before and after;
    - every Metro launch path changed;
    - whether any Metro server was reachable beyond loopback;
    - whether Windows, shared workstations, devcontainers, Codespaces, CI, or
      agent workbenches were in scope;
    - which credentials or files may have been reachable by the Metro process;
    - whether tokens and signing material were rotated, or why rotation is not
      required;
    - which validation commands passed.
12. Run available validation: package install, lockfile integrity, unit tests,
    mobile smoke tests, Metro local start with loopback binding, lint,
    typecheck, devcontainer render/build, CI config lint, container build,
    SBOM refresh, dependency/security scans, and a non-secret local smoke test
    that does not call `/open-url`.
13. Use PR title:
    `fix(sec): remediate CVE-2025-11953 in React Native CLI`

## Stop conditions

- No affected React Native Community CLI package, Metro launch path, wrapper,
  lockfile, image, devcontainer, CI/workbench config, or deployment artifact is
  controlled by this repository.
- The fixed React Native CLI line cannot be consumed without a broader mobile
  framework migration outside the current change.
- The only affected runtime is supplied by another team, platform image, or
  developer workstation owner; document owner, required version, exposure, and
  credential cleanup in `TRIAGE.md`.
- Product requirements intentionally depend on remote Metro access; require a
  product/security decision and a documented exception before preserving it.
- Safe verification would require live command execution, `/open-url`
  exploitation, production traffic, real device data, signing credentials, or
  other secrets.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.
~~~

## Rollback

Do not restore an affected CLI package and public Metro exposure together. If
an application change must be reverted, retain `18.0.1`, `19.1.2`, `20.0.0`,
or a later fixed compatible line. If that is temporarily impossible, bind Metro
to loopback and remove forwarded, tunneled, LAN, and internet access until the
fixed dependency and lockfile are restored.

## Verification - what the reviewer looks for

- No controlled manifest, lockfile, image, SBOM, generated report, global
  install, or launch path resolves `@react-native-community/cli-server-api` or
  `@react-native-community/cli` in the vulnerable range.
- Metro dev-server scripts bind to `127.0.0.1` by default, and any
  non-loopback exception has an explicit owner and reason.
- Devcontainers, Codespaces, CI jobs, shared workbenches, and Docker Compose do
  not publish Metro ports by default.
- Tests or policy checks catch stale package pins, unpinned CLI launch paths,
  accidental exposed hosts, and unsafe opener wrappers without executing
  commands.
- Operator notes cover Windows/shared-workstation exposure and credential or
  signing-key rotation when a vulnerable server was reachable.

## Output contract

- Reviewer-ready PR upgrading all controlled React Native Community CLI packages
  and refreshed locks, images, generated reports, SBOMs, and docs.
- Metro defaults bound to `127.0.0.1`, with Docker/devcontainer/Codespaces/CI
  exposure removed or documented through an explicit reviewed exception.
- Safe regression checks for vulnerable package pins, public Metro bindings,
  unpinned CLI launch paths, and unsafe opener wrappers without executing
  commands or calling `/open-url`.
- `TRIAGE.md` when the affected runtime, workbench, image, or credential
  cleanup owner is outside this repository.

## Watch for

- Updating `package.json` while `package-lock.json`, `pnpm-lock.yaml`,
  `yarn.lock`, Docker layers, devcontainer caches, or SBOMs still resolve a
  vulnerable CLI/server-api package.
- Treating Metro as safe because it is a dev server while it is actually
  forwarded through a remote IDE, Codespace, tunnel, Docker port, LAN, or
  browser-agent workbench.
- Fixing `start` while leaving `run-android`, `run-ios`, `run-windows`,
  `run-macos`, IDE tasks, or package-manager aliases exposed.
- Ignoring Windows developer workflows, where attacker-controlled command
  arguments make exploitation more severe.
- Adding diagnostics that print `.env` values, signing paths, emulator data,
  command output, local usernames, or full shell/open commands.

## Related recipes

- [Search the CVE Database for CVE-2025-12735](/cve-database/?q=CVE-2025-12735#cve-catalog)
- [Browser agent boundary]({{< relref "/security-remediation/browser-agent-boundary" >}})
- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})

## References

- GitHub reviewed advisory: <https://github.com/advisories/GHSA-399j-vxmf-hjvr>
- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2025-11953>
- JFrog advisory: <https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/>
- Fix commit: <https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547>
- React Native Community CLI 18.0.1 release: <https://github.com/react-native-community/cli/releases/tag/v18.0.1>
- React Native Community CLI 19.1.2 release: <https://github.com/react-native-community/cli/releases/tag/v19.1.2>
- React Native Community CLI 20.0.0 release: <https://github.com/react-native-community/cli/releases/tag/v20.0.0>
- CISA KEV entry: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953>

description: CVE-2025-11953 (Metro4Shell) is a critical React Native CLI command injection. Upgrade to 18.0.1, 19.1.2, or 20.0.0 and restrict Metro exposure.

maturity: stable

model: GPT 5.5 Extra High reasoning

title: CVE-2025-11953: Metro4Shell React Native CLI RCE

vendor: react-native-community

quality: curated

recipe_kind: markdown-override

summary: The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.


default_status: unknown

product: WISECP

summary: Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. Co. WISECP allows Cross Site Request Forgery. This issue affects WISECP: through 20022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


product: TheGreenBow VPN Client Windows Enterprise

vendor: TheGreenBow

summary: Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the OCSP-enabled VPN client establishes the tunnel even if it does not receive an OCSP response or if the OCSP response signature is invalid.


vendor: Proliz Software Ltd. Co.

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS. This issue affects OBS (Student Affairs Information System): before 25.0401.


product: Server

vendor: Devolutions

vendor: devolutions

summary: Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.

title: Devolutions Devolutions Server security vulnerability


summary: An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.


summary: Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc. Excavation Management Information System allows Footprinting, Functionality Misuse. This issue affects Excavation Management Information System: before v.10.2025.01.

title: Premierturk Information Technologies Inc. Excavation Management Informa… security vulnerability


product: KVKNET

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS. This issue affects KVKNET: before 2.1.8.

title: Aryom Software High Technology Systems Inc. Kvknet security vulnerability


product: Digital Corporate Warehouse

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22.

title: Divvydrive Information Technologies Inc. Digital Corporate Warehouse security vulnerability


product: StarCities

vendor: Saysis Computer Systems Trade Ltd. Co.

summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61.

title: Saysis Computer Systems Trade Ltd. Co. Starcities security vulnerability


vendor: Eclipse Foundation

version_type: maven

vendor: eclipse

summary: In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').

title: Eclipse Vert.X security vulnerability


summary: In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

title: Eclipse Vert.X security vulnerability


product: Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails

vendor: getwpfunnels

version_type: semver

ecosystem: php/wordpress

summary: The Mail Mint plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_contact_attribute_import function in all versions up to, and including, 1.18.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation… security vulnerability


vendor: emplibot

archetype: ssrf

summary: The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the emplibot_call_webhook_with_error() and emplibot_process_zip_data() functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

title: Emplibot Emplibot – Ai Content Writer With Keyword Research, Infographi… security vulnerability


product: GitLab

vendor: GitLab

product: gitlab

vendor: gitlab

summary: GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.

title: Gitlab security vulnerability


vendor: stevejburge

summary: The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Stevejburge Tag, Category, And Taxonomy Manager – Ai Autotagger With Op… security vulnerability


vendor: zhengdon

summary: The plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

title: Zhengdon security vulnerability


summary: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

title: Gitlab security vulnerability


vendor: fusewp

summary: The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_changes() function in all versions up to, and including, 1.1.23.0. This makes it possible for unauthenticated attackers to add and edit sync rules.

title: Fusewp Fusewp – Wordpress User Sync To Email List & Marketing Automatio… security vulnerability


summary: The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23.0. This is due to missing or incorrect nonce validation on the save_changes function. This makes it possible for unauthenticated attackers to add or edit sync rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


vendor: happyforms

summary: The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

title: Happyforms Happyforms – Form Builder For Wordpress: Drag & Drop Contact… security vulnerability


vendor: MongoDB Inc.

version_type: Custom

product: mongodb

vendor: mongodb

summary: An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.


product: Quick Featured Images

vendor: kybernetikservices

summary: The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted they can convince an author-level user or higher to add a malicious custom field value.

title: Kybernetikservices Quick Featured Images security vulnerability


vendor: jdsofttech

summary: The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Jdsofttech School Management System – Wpschoolpress security vulnerability


product: WP Discourse

vendor: scossar

summary: The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditionally sending Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization. This makes it possible for authenticated attackers, with author-level access and above, to exfiltrate sensitive Discourse API credentials to attacker-controlled servers, as well as query internal services and potentially perform further attacks.


summary: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authentication by manipulating the session state under certain conditions.

title: Gitlab security vulnerability


product: Realty Portal

vendor: nootheme

summary: The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

title: Nootheme Realty Portal security vulnerability


product: Crypto Tool

vendor: odude

summary: The Crypto plugin for WordPress is vulnerable to Information exposure in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the register and savenft methods with only a publicly-available nonce check and no wallet signature verification. This makes it possible for unauthenticated attackers to set a site-wide global authentication state via a single transient, bypassing all access controls for ALL visitors to the site. The impact is complete bypass of [crypto-block] shortcode restrictions and page-level access controls, affecting all site visitors for one hour, plus the ability to inject arbitrary data into the plugin's custom_users table.


product: Visual Link Preview

vendor: brechtvds

summary: The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Brechtvds Visual Link Preview security vulnerability


summary: The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts.


summary: GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

title: Gitlab security vulnerability


vendor: jetmonsters

summary: The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

title: Jetmonsters Jetformbuilder — Dynamic Blocks Form Builder security vulnerability


product: Multi Item Responsive Slider

vendor: cnaveenkumar

summary: The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'mioptions.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


vendor: sbthemes

summary: The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization of untrusted data supplied via the import configuration feature without capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No POP chain is present within the vulnerable plugin itself, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow an attacker to delete arbitrary files, retrieve sensitive data, or execute code.

title: Sbthemes Woocommerce Infinite Scroll And Ajax Pagination security vulnerability


product: Easy Email Subscription

vendor: yudiz

summary: The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Yudiz Easy Email Subscription security vulnerability


product: Community Events

vendor: jackdewey

summary: The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Jackdewey Community Events security vulnerability


product: Find Unused Images

vendor: toastwebsites

summary: The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.

title: Toastwebsites Find Unused Images security vulnerability


vendor: ngothoai

summary: The Document Pro Elementor – Documentation & Knowledge Base plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.9. This is due to the plugin exposing sensitive Algolia API keys through the frontend JavaScript code via wp_localize_script without proper access restrictions. This makes it possible for unauthenticated attackers to view sensitive API keys in the page source, which could be leveraged to make unauthorized API calls to the configured Algolia search service.

title: Ngothoai Document Pro Elementor – Documentation & Knowledge Base security vulnerability


product: Card Readers B Model

vendor: HP Inc.

summary: The following HP Card Readers B Models (X3D03B & Y7C05B) are potentially vulnerable to information disclosure, allowing prior user identity to be inherited under certain conditions —e.g., when an NFC device (such as a smartphone/smartwatches) is in proximity during a card swipe event.

title: Hp Inc. Card Readers B Model security vulnerability


product: Multi Location Marker

vendor: krishaweb

summary: The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to update the map API and reset maps.

title: Krishaweb Multi Location Marker security vulnerability