CVE Vulnerability Catalog

The Etoile Web Design Front End Users plugin versions <= 3.2.24 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The Membership plugin for WordPress before version 3.2.3 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability. This could be exploited against high privilege users such as administrators.

The Autochat Automatic Conversation plugin for WordPress versions up to 1.1.7 does not sanitize and escape user input before outputting it back on the page, leading to a cross-site scripting attack.

CSRF vulnerability in WooCommerce Brands plugin versions <= 1.6.49 allows attackers to perform unauthorized actions on behalf of users.

The myCred plugin versions up to 2.5 contain a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of users.

The Zip Recipes plugin versions <= 8.0.7 contains a Cross-Site Request Forgery (CSRF) vulnerability that can be exploited to perform unauthorized actions on behalf of the user.

The WP PDF Generator plugin by wpexperts.Io versions up to 1.2.2 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

Reactive web applications using Spring HATEOAS to produce hypermedia-based responses may be exposed to malicious forwarded headers if not behind a trusted proxy or lacking mechanisms to handle such headers.

CVE-2023-3700 vulnerability involves authorization bypass through a user-controlled key in the GitHub repository alextselegidis/easyappointments prior to version 1.5.0.

A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the 'category' argument in the add-product.php file leads to SQL injection, allowing for remote attacks.

IBM Db2 for Linux, UNIX and Windows version 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.

A critical vulnerability has been found in the House Rental and Property Listing application version 1.0, affecting unknown processing of the /index.php file. Manipulation of the keywords/location argument leads to SQL injection.

IBM InfoSphere Information Server version 11.7 could allow a remote attacker to obtain system information using a specially crafted query, which could aid in further attacks against the system.

A critical vulnerability has been found in Bylancer QuickOrder 6.3.7, affecting some unknown functionality of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability was found in Bylancer QuickQR version 6.3.7, affecting an unknown functionality of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability has been found in Bylancer QuickJob 6.1, affecting an unknown function of the GET Parameter Handler component. Manipulation of the keywords/gender argument leads to SQL injection.

A critical vulnerability was found in Bylancer QuickVCard 2.1, affecting unknown processing of the file /blog in the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability was found in Bylancer QuickAI OpenAI 3.8.1, affecting unknown code in the /blog file of the GET Parameter Handler component. Manipulation of the argument s leads to SQL injection.

A critical vulnerability was found in Nesote Inout Blockchain EasyPayments 1.0, affecting an unknown function of the file /index.php/payment/getcoinaddress. Manipulation of the argument coinid leads to SQL injection.