CVE Vulnerability Catalog

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 2.0.5 due to insufficient escaping on user-supplied parameters and lack of proper query preparation. This allows unauthenticated attackers to append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

The Shuffle theme for WordPress up to version 1.8 is vulnerable to Local File Inclusion. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution when images and other 'safe' file types can be uploaded and included.

The NotificationX Pro plugin for WordPress up to version 3.1.4 is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses an injected page.

The Verdure Core plugin for WordPress up to version 1.2 is vulnerable to Local File Inclusion. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution when images and other 'safe' file types can be uploaded and included.

The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.

The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. A visitor who knows a topic identifier from the public forum can submit a modified update request directly and overwrite its content without ownership confirmation. Topic identifiers are publicly visible, and exploitation requires no privileged access or non-default configuration.

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. A visitor who knows a company record identifier from the public directory can submit a modified update request directly and overwrite its data without ownership confirmation.

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.

The extension fails to safely process untrusted client input from an attacker-controlled cookie directly into PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" backend module.

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.