CVE Vulnerability Catalog

A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the file /api/employees. Executing manipulation can lead to missing authentication. It is possible to launch the attack remotely, and the exploit has been made available to the public. This product takes the approach of rolling releases, and the vendor was contacted but did not respond. This vulnerability only affects products that are no longer supported by the maintainer.

SolarEdge monitoring platform contains a Cross-Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt.

SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug commands.

The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 stores exported CSV files in a publicly accessible directory with predictable filenames. Unauthenticated attackers can access sensitive user data including emails, IP addresses, usernames, roles, and location data.

The Secure Copy Content Protection and Content Locking plugin for WordPress up to version 4.9.2 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the 'ays_sccp_results_export_file' AJAX action. This allows unauthenticated attackers to export sensitive plugin data including email addresses, IP addresses, physical addresses, user IDs, and other user information via a forged request if they can trick a site administrator into clicking a link. The exported data is stored in a publicly accessible file, allowing attackers to receive the sensitive information even though they are not authenticated.

The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to and including 1.0.6. Authenticated attackers with Subscriber-level access and above can retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.

The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Events Manager plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 7.2.2.2 via the 'get_location' action due to insufficient restrictions on which locations can be included. Unauthenticated attackers can extract data from password-protected, private, or draft event locations.

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 7.2.2.2. This is due to missing or incorrect nonce validation on the 'location_delete' action, allowing unauthenticated attackers to delete locations via a forged request if they can trick a site administrator into clicking a link.

The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugin's Stripe payment options.

Apache Fineract through version 1.10.1 contains a weak password requirements vulnerability. The issue is fixed in version 1.11.0, and users are encouraged to upgrade to the latest release, version 1.13.0.

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to and including 6.3.3. Authenticated attackers with Subscriber-level access and above can duplicate arbitrary posts, including password protected or private ones.

The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to stored cross-site scripting via the 'form_description' and 'success_message' parameters in versions up to, and including, 1.7.16 due to insufficient input sanitization and output escaping. An authenticated attacker with administrator access or higher can inject arbitrary web scripts into pages.

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress up to version 5.9.10 is vulnerable to Missing Authorization in the run_action_scheduler_task function. This allows unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage.

The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[csv]` shortcode. This is due to insufficient path validation before concatenating user-supplied input to a base directory path. This makes it possible for authenticated attackers with Contributor-level access and above to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.

Frappe Learning Management System (LMS) prior to version 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This issue is fixed in version 2.42.0.

The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to and including 3.7.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access and above to inject arbitrary web scripts that execute when a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The VikRentItems Flexible Rental Management System plugin for WordPress (all versions up to and including 1.2.0) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'delto' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that execute if a user is tricked into clicking a link.

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.