CVE Vulnerability Catalog

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to and including 1.27.133. This allows authenticated attackers to create posts of any type and status.

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post', and 'azh_remove_post' functions.

The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via 'azh_post' shortcode in versions up to and including 1.27.133 due to insufficient input sanitization and output escaping.

eMedia Consulting simpleRedak up to version 2.47.23.05 was discovered to contain a reflected XSS vulnerability via the component /scheduler/index.php.

eMedia Consulting simpleRedak up to version 2.47.23.05 was found to contain a reflected XSS vulnerability via the component /view/cb/format_642.php.

A Cross-site Scripting (XSS) vulnerability was identified in the GitHub repository tsolucio/corebos prior to version 8 via evvtgendoc.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8, allowing malicious code to be stored in the application.

A Cross-site Scripting (XSS) vulnerability - Stored in the GitHub repository tsolucio/corebos prior to version 8.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository tsolucio/corebos prior to version 8, allowing malicious code to be stored in the application.

Under certain circumstances, a call to the bind function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Using a redirect embedded into sourceMappingUrls could allow for navigation to external protocol links in sandboxed iframes without allow-top-navigation-to-custom-protocols. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Under specific circumstances a WebExtension may have received a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

A website could obscure the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could lead to user confusion and possible spoofing attacks. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

A critical vulnerability has been found in Campcodes Retro Cellphone Online Store version 1.0. Manipulation of the 'category' argument in the /admin/modal_add_product.php file leads to SQL injection, allowing for remote attack execution.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository zadam/trilium prior to version 0.59.4, allowing for the storage of malicious code.

A critical vulnerability was found in the Agro-School Management System version 1.0. Manipulation of the 'password' argument in the index.php file leads to SQL injection.