CVE Vulnerability Catalog

The Forminator Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.

The MetForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace transformation of script tags into JavaScript template literal expressions provides an additional delivery path.

The CM Map Locations plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected product installed and can receive UDP packets from that system.

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets from that system. Note that this vulnerability is due to an incomplete fix for CVE-2024-41726.

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If exploited, an attacker who can log into a Windows system with the affected product installed may execute arbitrary code on another Windows system that has the affected products installed and can receive UDP packets. This vulnerability is due to an incomplete fix for CVE-2024-41726.

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If exploited, an attacker who can log into the Windows system with the affected product installed may execute arbitrary code with SYSTEM privilege.

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. It impacts the function deepExtend in libs/deep/src/deepExtend.ts, leading to improperly controlled modification of object prototype attributes. Remote exploitation is possible, and the exploit has been disclosed. Upgrading to version 4.4.1 fixes the issue.

A path traversal vulnerability was found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0, affecting the unzip function in dist/index.js during archive extraction. Manipulating the destination argument can lead to path traversal. The attack can only be executed locally, and the exploit has been published.

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.7. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution when images and other 'safe' file types can be uploaded and included.

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to and including 1.4.2. This allows unauthenticated attackers to elevate their privileges to administrator level.

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted functions are pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite in src/index.js. Manipulation of the argument file_path results in argument injection, and the attack may be initiated remotely.

The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. A crafted image can cause a shift overflow or oversized block size, leading to an out-of-bounds write into static memory in kernel mode.

The OCPP 1.6 client contains a stack buffer overflow in parse_getconfig_msg(). An attacker controlling the central system or performing a man-in-the-middle attack can send a GetConfiguration request with a key longer than 50 bytes, causing a stack overflow in the reader thread.