CVE Vulnerability Catalog

The Advance WP Query Search Filter WordPress plugin through version 1.0.10 does not sanitize and escape a parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting. This can be exploited against high-privilege users such as administrators.

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. Affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginController.java. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public. The project was informed but has not responded.

A vulnerability was found in code-projects Student File Management System 1.0, specifically in the /download.php file (File Download Handler component). Manipulation of the 'store_id' argument leads to improper authorization. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was detected in Refugee Food Management System 1.0 in the file /home/regfood.php. Manipulation of the 'a' argument allows SQL injection, and the attack can be performed remotely. The exploit is publicly available and may be used.

A flaw has been found in code-projects Refugee Food Management System 1.0. It impacts an unknown function in the file /home/refugee.php. Manipulation of arguments refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to SQL injection. The attack can be executed remotely, and the exploit has been published.

The JetTabs plugin for WordPress (from Crocoblock) contains a DOM-Based XSS vulnerability in versions up to and including 2.2.12. Improper neutralization of input during web page generation allows DOM-based XSS attack.

The JetTabs plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.2.12.

To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.

The WP Project Manager plugin by weDevs is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 3.0.1.

A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. It affects unknown code in the file /home/editrefugee.php. Manipulation of arguments a/b/c/sex/d/e/nationality_nid leads to SQL injection. The attack may be launched remotely, and the exploit has been publicly disclosed.

A weakness has been identified in code-projects Refugee Food Management System 1.0. It affects an unknown part of the file /home/editfood.php. Manipulation of arguments a/b/c/d causes SQL injection. The attack may be initiated remotely, and the exploit has been made available to the public.

Custom Field Template up to version 2.7.7 contains a Stored XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to permanently inject a malicious script that will execute in other users' browsers.

JetSearch up to version 3.5.16 contains a DOM-Based XSS vulnerability due to improper input neutralization during web page generation. This allows an attacker to execute malicious scripts in the victim's browser.

The JetBlog plugin by Crocoblock is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This issue affects JetBlog versions from n/a through 2.4.7.

The JetPopup plugin by Crocoblock is vulnerable to authorization bypass through user-controlled key, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.0.20.1.

Micro Registration Utility (µURU) is a telephone self registration utility based on Asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can craft a special federation name and inject characters treated special by Asterisk into the Dial() application due to improper input validation. This allows redirecting calls on both federating instances. However, it requires that an admin accept the federation requests. As of publication, no known patched version is available.

A vulnerability was identified in code-projects Student File Management System 1.0. It affects an unknown functionality in the file /download.php. Manipulation of the argument istore_id leads to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.

Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignoring request headers like Authorization. After v1.11.1, automatic Vary header support is enabled by default.

A vulnerability in the SSH server of TP-Link TL-WR820N v2.80 allows the use of a weak cryptographic algorithm, enabling an adjacent attacker to intercept and decrypt SSH traffic. Exploitation may expose sensitive information and compromise confidentiality.

libheif before version 1.21.0 has a heap buffer over-read vulnerability in HeifPixelImage::overlay(), triggered by a crafted HEIF file with an overlay image item. This can lead to program crash.