CVE Vulnerability Catalog

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux. In some configurations it allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim's browser.

The Conformer for Elementor plugin up to version 1.0.7 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Logger for Elementor plugin up to version 1.0.9 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Worker for WPBakery plugin up to version 1.1.1 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Worker for Elementor plugin up to version 1.0.10 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

A Path Traversal vulnerability of type '.../...//' in the Pro Bulk Watermark plugin for WordPress (pro-watermark) allows an attacker to access files outside the intended directory. Affects versions up to and including 2.0.

The Headinger for Elementor plugin up to version 1.1.4 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Criptopayer for Elementor plugin up to version 1.0.1 contains a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels.

The Countdowner for Elementor plugin up to version 1.0.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized operations in the admin panel.

The Appender plugin up to version 1.1.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. An attacker can perform operations without proper permissions.

The UnGrabber plugin up to version 3.1.3 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. This could enable unauthorized administrative actions.

ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management.

A vulnerability was detected in iCMS up to version 8.0.0. The Save function in the file app/config/ConfigAdmincp.php of the POST Parameter Handler component allows code injection via manipulation of the config argument. The attack can be launched remotely, and the exploit is now public.

A vulnerability was detected in Kohana KodiCMS up to version 13.82.135. The Save function in the file cms/modules/kodicms/classes/kodicms/model/file.php of the Layout API Endpoint component allows code injection via manipulation of the content argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.

The Behance Portfolio Manager plugin for WordPress has a stored XSS vulnerability due to improper input neutralization. Attackers can inject scripts that run for users. Affects versions from n/a through 1.7.5.

The Accessibility Press plugin for WordPress has a stored XSS vulnerability due to improper input neutralization. This allows script injection that executes for admins and users. Affects versions from n/a through 1.0.2.

The Dashboard Beacon plugin for WordPress has a stored XSS vulnerability due to improper input neutralization. This allows script execution in the admin dashboard context. Affects versions from n/a through 1.2.0.

A vulnerability has been identified in Kohana KodiCMS up to 13.82.135, affecting the like function in cms/modules/pages/classes/kodicms/model/page.php of the Search API Endpoint component. Manipulating the keyword argument can lead to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A weakness has been identified in D-Link DIR-806A 100CNb11. Affected is the function ssdpcgi_main of the component SSDP Request Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. This vulnerability only affects products that are no longer supported by the maintainer.