CVE Vulnerability Catalog

The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it.

WordPress Core (all versions up to and including 7.0.2) is vulnerable to stored Cross-Site Scripting via Quick Edit due to insufficient escaping of user display names. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a higher-privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.

The WordPress plugin Photo Engine (Media Organizer & Lightroom) before version 6.5.8 does not verify that a user is authorized to act on the targeted media attachment. Authenticated users with the author role and above can delete arbitrary attachments, including those uploaded by other users and administrators.

The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks.

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state.

The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all review fields submitted through its public review form, which is available to unauthenticated visitors. This allows execution of arbitrary shortcodes when the affected field is displayed, provided user reviews and that field's display are enabled.

The FluentCart WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they place and read it back, disclosing customers' postal addresses, phone numbers and company details.

NT OneAPP developed by NewType Infortech has an exposure of sensitive information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.

NT OneAPP by NewType Infortech contains an authentication bypass vulnerability. An unauthenticated local attacker can bypass the App PIN lock mechanism via a Deep Link and access protected resources of a logged-in user.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (utils/modcss action). The fetched stylesheet was read into memory in full with no size limit and no read timeout, allowing server memory exhaustion via an attacker-controlled stylesheet URL.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; thus markup in an HTML message caused remote content to be loaded without the user's consent, disclosing the client IP address and confirming that the message was opened. Upstream fixed this in the commit “Fix remote-content blocker bypass via SVG SMIL `by` attribute”.

The Drupal Webform module contains an Incorrect Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 6.2.12 and from 6.3.0 to 6.3.1.

A missing authorization vulnerability in the Drupal Webform REST module allows forceful browsing. This issue affects Webform REST versions from 0.0.0 to 4.2.1.

The Drupal module Editoria11y Accessibility Checker contains a Privilege Defined With Unsafe Actions vulnerability that allows privilege escalation. This affects versions from 0.0.0 to 2.2.23 and from 3.0.0 to 3.0.9.

The Drupal Tawk.to - Live chat application module contains a Cross-Site Request Forgery (CSRF) vulnerability that may allow unwanted actions on behalf of a logged-in user. The issue affects versions from 0.0.0 to 3.0.4.

The Drupal Smart Content module contains a Missing Authorization vulnerability that allows Forceful Browsing. The issue affects versions from 0.0.0 to 3.2.1.

The Drupal REST & JSON API Authentication module contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows bypassing authentication. The issue affects versions from 0.0.0 to 3.2.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions from 0.0.0 to 3.0.2.

The Drupal module CSS Usage Analyzer contains a Missing Authorization vulnerability that allows forceful browsing. This affects versions from 1.0.0 to 1.0.2.