CVE Vulnerability Catalog

Persistent XSS in MyBB Last User's Threads in Profile Plugin 1.2. Attackers can inject malicious scripts by creating threads with script tags in the subject, which execute when visiting the attacker's profile page.

MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inject malicious scripts through the download title field. Attackers can submit a new download with HTML/JavaScript code in the title parameter, which executes when administrators validate the download in downloads.php.

A denial of service vulnerability exists in 7 Tik 1.0.1.0. Attackers can crash the application by submitting an excessively long input string (7700 characters) into the search bar.

VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of characters into the search bar to trigger an unhandled exception that terminates the application.

sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service. Local attackers can exploit this by placing a malicious executable in the unquoted path and triggering a service or system restart to execute code with LocalSystem privileges.

Hotspot Shield 6.0.3 contains an unquoted service path vulnerability in the hshld service binary that allows local attackers to escalate privileges by injecting malicious executables. Attackers can place executable files in the service path and upon service restart or system reboot, the malicious code executes with LocalSystem privileges.

IObit Malware Fighter 4.3.1 has an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services. A local attacker can place a malicious executable in the unquoted path, leading to privilege escalation to LocalSystem upon service restart or system reboot.

The vulnerability in Netgate AMITI Antivirus build 23.0.305 involves an unquoted service path in the AmitiAvSrv and AmitiAntivirusHealth services. A local attacker can place a malicious executable in this path and after a service restart or system reboot gain LocalSystem privileges.

NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.

Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv services, allowing local attackers to escalate privileges by inserting malicious executables. Attackers can place executable files in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.

The AdvancedSystemCareService10 service in IObit Advanced SystemCare 10.0.2 has an unquoted service path vulnerability. A local attacker can place a malicious executable in the service path, leading to privilege escalation to LocalSystem when the service restarts or the system reboots.

The wpForo Forum plugin for WordPress up to version 2.4.16 has an arbitrary file deletion vulnerability. Missing file path validation allows authenticated attackers with subscriber-level access and above to delete arbitrary files on the server by embedding a crafted path traversal string in a forum post body and then deleting the post.

The Visitor Traffic Real Time Statistics plugin for WordPress up to version 8.4 is vulnerable to stored XSS via the 'page_title' parameter. An unauthenticated attacker can inject scripts that execute when an admin accesses the Traffic by Title section.

The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress in versions up to 1.9.8 contains hardcoded MySQL database credentials for the vendor's external telemetry server in the Mementor_TTS_Remote_Telemetry class. This allows unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.

The Widgets for Social Photo Feed plugin for WordPress up to version 1.7.9 is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

The ProfilePress plugin for WordPress up to version 4.16.11 has a vulnerability allowing unauthorized membership payment bypass. Missing ownership verification on the change_plan_sub_id parameter in process_checkout() allows authenticated attackers (subscriber level and above) to reference another user's active subscription, manipulate proration calculations, and obtain paid lifetime membership plans without payment.

The WCFM – Frontend Manager for WooCommerce plugin for WordPress (up to version 6.7.25) has an Insecure Direct Object Reference (IDOR) vulnerability in multiple AJAX actions. Missing validation on user-supplied object IDs allows authenticated attackers with Vendor-level access or higher to modify any order, delete or modify any post/product/page regardless of ownership.

Electron versions from 39.0.0-alpha.1 to before 39.8.0, 40.0.0-alpha.1 to before 40.7.0, and 41.0.0-alpha.1 to before 41.0.0-beta.8 contain a context isolation bypass vulnerability. Apps that pass VideoFrame objects (from the WebCodecs API) across the contextBridge are vulnerable. An attacker who can execute JavaScript in the main world (e.g., via XSS) can use a bridged VideoFrame to gain access to the isolated world, including any Node.js APIs exposed to the preload script.

PraisonAI before version 4.5.97 contains a vulnerability in SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED). The subprocess.run() function is called with shell=True and relies solely on string-pattern matching to block dangerous commands. The blocklist does not include sh or bash as standalone executables, allowing trivial sandbox escape in STRICT mode via sh -c '<command>'.

Electron before versions 39.8.1, 40.7.0, and 41.0.0 has a use-after-free vulnerability in apps using offscreen rendering and allowing child windows via window.open(). Destroying the parent WebContents while a child window is open can lead to a crash or memory corruption.