CVE Vulnerability Catalog

The Thim Core plugin by ThimPress contains a Cross-Site Request Forgery vulnerability in versions from n/a through 2.3.3. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

The LoginWP - Pro plugin contains a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. The issue affects versions up to and including 4.0.8.5.

The Dokan Pro WordPress plugin has a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects all versions up to 3.14.5.

Apache SIS has an XML External Entity (XXE) vulnerability that allows an attacker to disclose local file contents on the server when parsing certain formats (GeoTIFF, ISO 19115, GML, GPX). Affects versions 0.4 through 1.5.

Wallet System for WooCommerce (wallet-system-for-woocommerce) has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions through 2.7.3.

Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a through <= 3.2.26.

The AnyWhere Elementor Pro plugin (versions up to and including 2.29) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

QOCA aim AI Medical Cloud Platform by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under a specified path via Absolute Path Traversal.

QOCA aim AI Medical Cloud Platform by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under a specified path via Absolute Path Traversal.

The QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify specific network packet parameters. This enables certain system functions to access other users' files.

A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery Request Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderHosNum of the file /ssm_pro/orderHos/. Such manipulation of the argument hospitalAddress/hospitalName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user's session and perform actions in their security context.

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in the JavaMall project (cld378632668) in the Upload function of MinioController.java. Input manipulation leads to unrestricted file upload, and the attack can be launched remotely. The product uses rolling releases, so version details are unavailable, and the vendor did not respond to the disclosure.

JFrog Artifactory (Workers) versions from 7.94.0 through <7.117.10 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This could allow execution of malicious script in the user's browser.

A broken access control vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information.

A vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows unauthorized access to device hardware information through insecure API endpoints. Attackers can exploit pet IDs to retrieve serial numbers and MAC addresses, leading to full device control.