CVE Vulnerability Catalog

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker to access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

BOLA in Cervantes version v1.3-beta could allow an attacker to modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS. This issue affects Ad Inserter: from n/a through 2.8.18.

A stored XSS vulnerability exists in the “Notes” field of the Checklists in Cervantes version v1.3-beta. An attacker can store malicious code that is later executed in another user's browser with elevated privileges.

The WordPress plugin 'All-in-One Video Gallery' (versions up to 4.9.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.

The WordPress plugin 'LiteSpeed Cache' (versions up to 7.9) is vulnerable to insertion of sensitive information into sent data, which may allow retrieval of embedded sensitive data. An attacker could gain access to information that should not be disclosed.

The WordPress plugin 'SureDash' (versions up to 1.12.2) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker could perform actions they should not be authorized to do.

A vulnerability was found in Scada-LTS 2.8.0 in the HttpServletRequest.getParameter function of AmChartValuesAPI.java within the AmCharts Data API component. Manipulating the ids argument can lead to authorization bypass, and the attack can be executed remotely. The exploit has been published and may be used.

A weakness was identified in InternScience InternAgent 1.5.0 in the train function of tasks/AutoChem/code/experiment.py within the LoRA Loading component. Manipulating the base_model_name_or_path argument causes inclusion of functionality from an untrusted control sphere. The attack may be initiated remotely, and the exploit has been made publicly available.

BigFix Platform uses the Mozilla CA certificate bundle (PEM). Bundle versions dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application.

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions. This allows users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users.

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions. This allows authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor plugin from the WordPress.org repository.

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms. This allows unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the plugin's content restrictions and registration gating.

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end. This could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers. This allows unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing. This allows users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension; a disclosed file is re-published at a public URL and its original is deleted as a side effect.