CVE Vulnerability Catalog

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the attack remotely, and the exploit has been made available to the public.

A vulnerability was found in the Linux kernel's cgroup subsystem, involving iteration over dying tasks with a zero reference count. This leads to a race condition where the iterator may access a task after it has been freed, resulting in a use-after-free.

A SQL injection vulnerability was discovered in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The unknown function in /updateguest.php is affected, and manipulation of arguments gname/editassid allows remote attacks. The exploit is publicly available.

A cross-site scripting (XSS) vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected component is Faculty Video Management in managevideos2.php, and manipulation of arguments V_Title/V_Url/V_Remarks allows remote attacks. The exploit is publicly available.

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file. This allows unauthenticated users to make the server issue requests to internal services and read the responses.

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form. This allows unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. Users with the Author role and above can store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.

The MCP Server for WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes. Users with the Contributor role can disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.

The MCP Server for WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes. Users with the Contributor role can modify, delete and create site-wide workflow configuration, including workflows created by administrators.

The MCP Server for WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present. This allows unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end. This allows users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query. This allows unauthenticated attackers to append additional SQL and extract sensitive information from the database.

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, and File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens. They accept any origin that is a leading string prefix of the site's own address, allowing an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it.

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement. This allows any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor. This allows any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor. This allows any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename. This allows unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.

The Request a Quote for WooCommerce plugin for WordPress up to version 2.9.2 is vulnerable to Arbitrary File Upload via the `afrfq_submit_quote_via_popup()` function. Missing file extension and MIME type validation in the popup upload handler allows unauthenticated attackers to upload executable files, such as PHP, to a web-accessible temporary RFQ upload directory.

The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes. This allows users with a WP Directory Kit-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.

The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.