CVE Vulnerability Catalog

The Tripzzy WordPress plugin before 1.5.1 does not have authorization checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users. This allows them to permanently delete arbitrary comments on the site.

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz. This allows a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code.

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the plugin's own capability-gated read path reserves to administrators.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

The Master Slider WordPress plugin through 3.11.2 does not sanitize and escape some shortcode attributes before outputting them in an inline script context, allowing users with Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed.

A flaw has been found in SxDevOps versions 1.0 and 1.1 in the subprocess.Popen function of the file backend/aiops/services.py (MCP STDIO Server Management component). Manipulation of the endpoint_or_command argument causes command injection, and the attack may be initiated remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A vulnerability was detected in NginxProxyManager (nginx-proxy-manager) up to version 2.15.1 in the internalCertificate.validate function of the file backend/internal/certificate.js (Validate Route component). Manipulation results in missing authentication, and the attack can be launched remotely. The exploit is now public and may be used; the endpoint only processes and echoes back the certificate submitted by the caller, and the real risk is unauthenticated openssl processing of attacker input.

A security vulnerability has been detected in itsourcecode Leave Management System 1.0 affecting an unknown function of the file /module/department/controller.php. Manipulation of the DEPTID argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A weakness in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1 affects the shm_malloc function in src/modules/cdp/receiver.c of the CDP Diameter Receiver component. Manipulation leads to a heap-based buffer overflow. The attack can be remote, and the exploit is public. Upgrading to 6.0.8 resolves the issue.

A security flaw in Dromara UJCMS up to 12.3.1 affects the usernameExist function in ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the UserController component. Manipulation of the Username argument results in improper authorization. The attack can be remote. The project has not responded yet.

Vulnerability in Pixelfed up to 0.12.11 affects the instancePeers function in app/Http/Controllers/Api/ApiV1Controller.php of the OAuth Scope Handler component. Manipulation of the ID argument leads to missing authentication. The attack can be remote, and the exploit is public. Upgrading to 0.12.10 is recommended (though description says 0.12.11, recommended is 0.12.10 – likely a typo).

The SmartLife app dynamically generates authentication parameters at runtime. Using these parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID for a registered email address. By spoofing the app authentication info with the target account ID, the attacker can reset the target account's password.