CVE Vulnerability Catalog

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk. This allows users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the plugin's stored configuration.

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route. This allows unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.

The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state. This allows unauthenticated attackers to forge a payment completion notification and create a completed order without paying.

A SQL injection vulnerability was found in pig-mesh pig up to version 4.1.0, affecting the orderItem.getColumn function in SqlFilterArgumentResolver.java. Manipulating the ascs/descs arguments allows SQL injection, and the attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in phpIPAM up to 1.8.3 in the create_rack_link function of app/tools/racks/show-rack-popup.php (Rack Link Creation component). Manipulation of the deviceid argument results in cross site scripting. The issue can be exploited remotely and a public exploit is already available.

A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 affecting the UnAuthController.changeStatus/close/open/resolve functions in app/Http/Controllers/Client/helpdesk/UnAuthController.php. Manipulating the id/status arguments leads to missing authorization, and the attack can be launched remotely.

A vulnerability was found in Travisun Opptrix 0.4.0 affecting the Buffer.concat function of the /api/channels/webhook/ file in the preParsing handler component. Manipulation results in denial of service, and the attack can be initiated remotely. The exploit has been made public and could be used.

The WpEvently plugin (versions up to 5.7.8) by Magepeople inc. contains a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages.

ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.

RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.

DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker to access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

BOLA in Cervantes version v1.3-beta could allow an attacker to modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS. This issue affects Ad Inserter: from n/a through 2.8.18.

A stored XSS vulnerability exists in the “Notes” field of the Checklists in Cervantes version v1.3-beta. An attacker can store malicious code that is later executed in another user's browser with elevated privileges.

The WordPress plugin 'All-in-One Video Gallery' (versions up to 4.9.7) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.