CVE Vulnerability Catalog

The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.1.6. Missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions allows unauthenticated attackers to modify plugin settings and create arbitrary filter options.

The Campay Woocommerce Payment Gateway plugin for WordPress in all versions up to and including 1.2.2 does not properly validate that a transaction has occurred through the payment gateway. This allows unauthenticated attackers to bypass payments and mark orders as successfully completed.

The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Better Elementor Addons plugin for WordPress in versions up to and including 1.5.5 is vulnerable to Stored Cross-Site Scripting via the Slider widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user visits the injected page.

The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.2.13. Missing capability check on the saveBrandsSettings function allows authenticated attackers with Subscriber-level access or above to modify brand permalink settings.

The Simple post listing plugin for WordPress up to version 0.2 contains a stored Cross-Site Scripting (XSS) vulnerability in the 'class_name' parameter in the postlist shortcode. This is due to insufficient input sanitization and output escaping on user-supplied attributes.

The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to and including 1.2.0. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts that execute when a user accesses a page.

The i++ command of the High Level Synthesis Compiler for Windows is vulnerable to a DLL planting attack.

An uncontrolled search path element vulnerability in Altera High Level Synthesis Compiler on Windows allows search order hijacking. Affects versions from 19.1 through 24.3.

The System Console Utility for Windows is vulnerable to a DLL planting attack.

When the user sets the Notification's sender to send emails to the SMTP server via msmtp, improperly validated TLS/SSL certificates allow an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle (MITM) attack, which may obtain sensitive SMTP information.

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 allow unauthenticated LAN gRPC requests, enabling administrative actions. The cross-origin policy can be bypassed by omitting a Referer header. An attacker can read tilt, rotation, and elevation data, making it easier to infer the dish's geographical location.

LibreChat in versions 0.8.0 and below lacks a handler for JSON parsing errors. SyntaxError from express.json() includes user input in the error message, which gets reflected in responses, creating an XSS risk if Content-Type isn't strictly enforced.

LibreChat versions 0.8.0 and below insufficiently validate JSON request bodies sent to the PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). The patchPromptGroup function passes req.body directly to updatePromptGroup() without filtering sensitive fields, allowing users to modify prompts in unintended ways.

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats with a potentially malicious 'tracker', resources loaded can lead to loss of privacy for users who view the chat link that is sent to them. This issue is fixed in version 0.8.1.

KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft malicious URLs to redirect users to arbitrary external websites after authentication.

A potential security vulnerability in Quartus Prime Pro Edition Design Software may allow escalation of privilege.

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts. Attackers can insert XSS payloads in the title field to execute arbitrary JavaScript when administrators view the currencies page.

XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page settings. Attackers can insert XSS payloads in footer templates and news ticker fields, enabling script execution for all forum users when pages are rendered.