CVE Vulnerability Catalog

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Manipulation of the argument editid leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. Manipulation of the argument makeid causes SQL injection. The attack can be initiated remotely, and the exploit has been made available to the public.

A SQL injection vulnerability was discovered in aaPanel BaoTa up to 11.8.0, affecting the get_domain_status function in /www/server/panel/mod/project/domain/domainMod.py (Domain Handler component). Manipulation of the get argument allows remote SQL injection. The exploit has been publicly released and the vendor did not respond to the disclosure.

A SQL injection vulnerability was identified in aaPanel BaoTa up to 11.8.0, affecting the getData function in /www/server/panel/class/data.py. Manipulation of the log_type argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available; the vendor did not respond to the disclosure.

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership. This allows unauthenticated users to mark any order as paid.

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to. This allows unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path. This allows the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to OS command injection. The attack may be performed from remote, and the exploit has been publicly disclosed.

A vulnerability was found in aaPanel BaoTa up to version 11.8.0 in the merge_split_file function of the file /www/server/panel/class/files.py in the File Merge Handler component. Manipulation of the split_file_path argument results in command injection, and the attack can be carried out remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Manipulation of the argument Password leads to OS command injection. The attack can be executed remotely, and the exploit has been disclosed to the public.

A vulnerability was found in Frappe HR up to 16.15.0, affecting the get_expense_claims/get_shift_requests/get_attendance_requests functions in hrms/api/__init__.py (Permission Validation component). Manipulation of the employee argument leads to incorrect authorization. The attack can be launched remotely; the vendor confirmed the issue has already been fixed.

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely, and the exploit is now public.

Joomla Extension regularlabs.com Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 is vulnerable to privileged stored XSS via data-rlta-url attributes. The plugin accepts a url option for an item and writes it to a generated data-rlta-url attribute, which the browser code passes to window.open() when the item is activated. Affected versions do not reject browser URL schemes that execute JavaScript.

Joomla Extension regularlabs.com Modules Anywhere versions 1.5.0 - 9.0.5 for Joomla is vulnerable to LFI / SSRF. Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter; Joomla's core Feed module opens the rssurl parameter server-side and accepts local file: URLs as well as network URLs.

A security vulnerability was detected in notionnext-org NotionNext up to 4.10.10, affecting the cleanCache function in pages/api/cache.js (Authentication Guard component). Manipulation of the token argument leads to missing authentication. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check; in versions 4.9.5.7 - 4.10.10 a guard exists but is only enforced when CACHE_REVALIDATION_TOKEN is set, so default deployments remain unprotected. The vendor did not respond to the disclosure.