CVE Vulnerability Catalog

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment, because the route matcher is case-sensitive while the filesystem is not. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect.

The Yo WordPress plugin from version 1.1 to 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping. This allows unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

The To Do List Member WordPress plugin from version 1.4 to 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content. This allows unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration. This allows users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them. This allows unauthenticated attackers to read any author's draft, pending and private car listings — including titles, prices, media URLs and seller notes — by supplying only the target's numeric user id.

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor. This allows unauthenticated attackers to permanently disable any popup on the site.

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page. This allows unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output. This allows authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it. This allows any authenticated user, such as a subscriber, to permanently delete every form submission the plugin has stored.

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions. This allows any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the plugin's native (non-WooCommerce) checkout, which is not the default.

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks. This allows unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it. This allows unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself. This allows any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it. This allows unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries. This allows unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user. This allows users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script. This allows unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash. This allows an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.