CVE Vulnerability Catalog

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files.

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.

Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

Unauthenticated IDOR vulnerabilities in PublishPress Permissions versions up to 4.8.3. An attacker without authentication can access unauthorized resources.

Unauthenticated Cross-Site Request Forgery (CSRF) in Mang Board WP versions up to 2.3.8.

Unauthenticated CSRF vulnerability in Simply Schedule Appointments versions up to 1.6.12.23. An attacker can exploit this to perform unauthorized actions in the context of a logged-in administrator.

Unauthenticated Broken Access Control vulnerability in Ultimate Gift Cards For WooCommerce versions up to 3.2.9. An attacker without authentication can bypass access controls.

Unauthenticated CSRF vulnerability in Activity Log versions up to 2.13.1. The vulnerability allows an attacker to perform unauthorized operations on behalf of an administrator.

Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing from n/a through 6.1.3.

Contributor Cross Site Scripting (XSS) vulnerability in WCFM Marketplace versions up to 3.8.2. A user with Contributor role can inject malicious script.

Unauthenticated Broken Access Control vulnerability in WP Event Solution versions up to 4.1.22. An attacker without authentication can bypass access controls.

Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Attachment: from n/a through 2.3.4.

Unauthenticated PHP object injection in Ninja Forms - Layout & Styles versions up to 3.0.31. An attacker can inject malicious PHP objects, potentially leading to remote code execution.

Unauthenticated XSS vulnerability in TrustedSite versions up to 1.2.5. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in Interactive Geo Maps versions up to 1.6.30. An attacker can inject a malicious script that executes in the victim's browser.