CVE Vulnerability Catalog

The WordPress Metform plugin (through version 4.3.2) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This allows exploitation of the flawed authorization settings.

The eRoom plugin by DigitalME, versions up to 1.7.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The H5P plugin up to version 1.17.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User input is not properly sanitized before being stored.

Missing Authorization vulnerability in WP Chill Strong Testimonials through 3.3.14 allows Exploiting Incorrectly Configured Access Control Security Levels. The flaw enables unauthorized access to functionality or data governed by access control.

The Falcon – WordPress Optimizations & Tweaks plugin by eLightUp, versions up to 2.12.0, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The MarketKing plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects MarketKing versions up to and including 2.1.72.

An out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (versions 4.1.0 to 5.3.0) occurs because the input size check did not include the preamble, allowing a truncated sketch to cause a read past the end. Additionally, the table size is computed in 32-bit arithmetic, which can wrap to zero, leading to an empty table and subsequent out-of-bounds reads and writes, corrupting heap memory.

The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.

WordPress Core (all versions up to and including 7.0.2) is vulnerable to stored Cross-Site Scripting via Quick Edit due to insufficient escaping of user display names. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a higher-privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

The WordPress plugin Photo Engine (Media Organizer & Lightroom) before version 6.5.8 does not verify that a user is authorized to act on the targeted media attachment. Authenticated users with the author role and above can delete arbitrary attachments, including those uploaded by other users and administrators.

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state.

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all review fields submitted through its public review form, which is available to unauthenticated visitors. This allows execution of arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.

The FluentCart WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

NT OneAPP developed by NewType Infortech has an exposure of sensitive information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.

NT OneAPP by NewType Infortech contains an authentication bypass vulnerability. An unauthenticated local attacker can bypass the App PIN lock mechanism via a Deep Link and access protected resources of a logged-in user.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (utils/modcss action). The fetched stylesheet was read into memory in full with no size limit and no read timeout, allowing server memory exhaustion via an attacker-controlled stylesheet URL.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; thus markup in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.