CVE Vulnerability Catalog

The GeoDirectory plugin for WordPress (versions up to and including 2.8.199) is vulnerable to Stored Cross-Site Scripting via the listing description (post_content). Insufficient input sanitization on save combined with the AyeCode UI library, which inserts the data-bs-content value as HTML into a popover, allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts.

In FreeRTOS-Kernel before V11.3.3, on MPU-enabled ports with queue sets enabled, missing queue-set type validation in the queue-set selection system call allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.

The GeoDirectory plugin for WordPress (all versions up to and including 2.8.198) is vulnerable to arbitrary shortcode execution. The software allows users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

The Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires the administrator to have disabled the default 'Be GDPR compliant' option and an additional administrator action.

The Themify Builder plugin for WordPress (versions up to and including 7.8.4) is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts. Insufficient input sanitization and output escaping on the variations post meta allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute on the Custom Fonts admin listing.

The Majestic Support plugin for WordPress (all versions up to and including 1.2.2) is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter due to insufficient escaping on user-supplied input and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with subscriber-level access and above to append additional SQL queries to extract sensitive information from the database.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user visits the injected page. This requires an administrator to have enabled the 'Allow visitors to upload videos to their profile' setting.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. This requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode.

The OpenStation plugin for WordPress (all versions up to and including 1.1.16) is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to modify arbitrary other users' placement rows and read serialized metadata. Exploitation requires at least one orphaned placement to exist and the attacker to self-enable OpenStation.

The JS Help Desk plugin for WordPress (versions up to and including 5.0.1) is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function. An authenticated attacker with administrator-level access can delete arbitrary files on the server, potentially leading to remote code execution if a critical file such as wp-config.php is deleted. Exploitation requires a two-step sequence: saving a traversal-crafted value in the support_custom_img configuration field, then triggering deletion by uploading a new support custom image.

The Redux Framework plugin for WordPress (versions up to and including 4.5.15) is vulnerable to stored cross-site scripting via the multi_media field. The field's renderer prints the stored value into an href attribute, a hidden input value, and an HTML element without escaping, and user_meta_save() checks permissions against a user ID from the request body, allowing a Subscriber to write a field declared for manage_options. An authenticated attacker with Subscriber-level access can inject arbitrary scripts into their own profile that execute when an administrator views that profile.

The Ad Inserter plugin for WordPress (versions up to and including 2.8.19) is vulnerable to arbitrary shortcode execution because it allows users to execute an action without properly validating a value before running do_shortcode. An unauthenticated attacker can execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.

In Frappe Learning Management System (LMS) prior to version 2.54.2, unpublished certificate records can be retrieved and viewed by users who should not have access. This can expose certificate details belonging to other users. The issue does not allow modifying data or gaining elevated privileges.

In Frappe Learning Management System (LMS) prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts.

In Frappe Learning Management System (LMS) prior to version 2.52.1, the course/certificate checkout flow accepts client-controlled pricing. An authenticated user can complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue that does not expose other users' data or grant elevated privileges.

In DBHub prior to version 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. A double dash followed by a non-whitespace character can hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection, can bypass read-only mode to modify or drop database data.

In ZAC prior to version 5.2.0, by-id read endpoints in ZaakRestService.kt omit assertPolicy authorization. An authenticated low-privileged municipal user who knows a case or decision UUID can read decisions, audit history, and BPMN workflow state across unauthorized case types. The advisory also identifies the afzender endpoint as exposing mailbox configuration without a policy check.

In SecureDrop from version 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request. An attacker who already has access to the Journalist Interface onion address, the required authentication, and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry (at most eight hours).