CVE Vulnerability Catalog

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could delete that Dag's queued asset events, silently suppressing asset-triggered scheduling.

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability. A low-privileged user could gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

HCL BigFix Service Management is affected by SQL Injection and Cross-Tenant Data Exposure vulnerabilities, which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to and including 3.8.2. Unauthenticated attackers can append additional SQL queries and extract sensitive information from the database.

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to and including 2.5.1. This is due to insufficient escaping and lack of prepared statements in the WPIMItem::get_all() function. Authenticated attackers with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_img_position' Post Meta in all versions up to and including 9.118.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.8.0 via the 'filename' parameter. Authenticated attackers with shop manager-level access or above can read the contents of arbitrary files on the server, which may contain sensitive information.

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to and including 4.5.1. The injection occurs in a numeric, unquoted SQL context, and the AJAX handler is accessible without authentication and without a nonce check.

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to and including 6.5.6 due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. This bypasses both WordPress core kses-on-save and the plugin's own wp_kses_post() because entity-encoded script tags are treated as inert text but decoded into live HTML.

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.8.5 via the 'mockups' parameter. An unauthenticated attacker can read arbitrary files on the server, and the required nonce is easily obtainable by unauthenticated users.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. Attackers with LatePoint Agent-level access or above can read bookings and customer PII (full name, email, phone, and notes) assigned to other agents, and delete arbitrary bookings. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles.

The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to and including 1.23.0 via the my_profile_update() function. The lack of nonce verification, capability checks, and meta key validation allows an authenticated attacker with Subscriber-level access to modify arbitrary user metadata.

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can permanently delete arbitrary posts, pages, and custom post types (bypassing the trash) or change any published post to draft status.

The TECHIN2B Application contains an Authorization Bypass Through User-Controlled Key vulnerability that allows Privilege Abuse. The issue affects versions from V1.0.7676.13 through 18092026.

The Bar Association Website by KA Informatics Technologies Ltd. Co. is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. This issue affects versions through 18092026. The vendor was contacted but did not respond.

The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.3.68 via the duplicate() function hooked on admin_init. This is due to the handler only verifying the generic 'edit_posts' capability and a plugin-wide static nonce without any object-level authorization check. Authenticated attackers with Author-level access or above can duplicate arbitrary Download Manager packages owned by other users, copying all package metadata including protected file references, role-based access restrictions, and password lock settings into an attacker-owned clone.

The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 11.8.2 via the wpbc_ajax_option_save AJAX action. An authenticated attacker with Editor-level access can write WordPress options such as default_role=administrator and create an administrator account.