CVE Vulnerability Catalog

Incorrect privilege assignment vulnerability in LiquidThemes Booking Hub allows privilege escalation. This issue affects versions from n/a through 1.3.1.

Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

Unauthenticated XSS vulnerability in MP3 Audio Player for Music, Radio & Podcast by Sonaar versions up to 5.13.1. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated XSS vulnerability in Upsell Order Bump Offer for WooCommerce versions up to 3.1.5. An attacker can inject a malicious script that executes in the victim's browser.

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

The WP User Frontend plugin in versions up to 4.3.10 contains a PHP Object Injection vulnerability exploitable by subscribers. An attacker with subscriber role can exploit this to perform unauthorized operations.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. Affects versions from n/a through 5.5.1.

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper in the connectivity service injects header values into a JSON template without proper escaping, allowing JSON structure break-out and injection of additional fields. An attacker controlling a header (e.g., MQTT 5 user property, AMQP 1.0 application property, or Kafka record header) can inject an inline _policy object, overriding the administrator-configured policyId.

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. This CVE is marked as 'low' since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution.

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network – including to cloud instance-metadata endpoints and other internal services – and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions.

The reset_password.html file parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.

The Broken Link Checker plugin for WordPress up to version 2.4.13 is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.

This CVE has been rejected by the requester.

This CVE has been rejected by the requester.

This CVE has been rejected by the requester.

This CVE has been rejected by the requester.

This CVE has been rejected by the requester.

This CVE has been rejected by the requester.