CVE Vulnerability Catalog

The Support Genix plugin for WordPress up to version 1.4.52 is vulnerable to authentication bypass leading to administrator account takeover via the guest_ticket_login() function and its p parameter. The site-wide AES-256-CBC encryption key is derived from only three two-digit wp_rand(10, 99) values and a Unix timestamp via md5(), yielding approximately 19.5 bits of entropy, combined with a deterministic IV. This allows authenticated attackers with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle, to recover the encryption key and forge a token for an administrator, leading to full administrative access.

The Listdom plugin for WordPress up to version 5.8.1 is vulnerable to stored cross-site scripting via the 'lsd[displ][style]' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' setting enabled.

The Affiliate Super Assistent plugin for WordPress up to version 1.10.2 is vulnerable to stored cross-site scripting via the doCommentShortcode function due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page.

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is only exploitable when the plugin's Login History feature is enabled.

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to and including 5.9.2. Authenticated attackers with administrator-level access can append additional SQL queries to existing ones, potentially extracting sensitive information from the database. This is a second-order injection where the payload is stored without sanitization and later used in SQL queries.

The Live Composer – Free WordPress Website Builder plugin is vulnerable to Stored Cross-Site Scripting via the 'dslc_custom_field' shortcode in all versions up to and including 2.1.19. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user visits the page.

The Live Composer – Free WordPress Website Builder plugin is vulnerable to Stored Cross-Site Scripting via the 'custom_id' shortcode attribute in versions up to and including 2.1.19. Insufficient output escaping allows authenticated attackers with contributor-level access to inject arbitrary scripts into the HTML id attribute, which execute when the page is accessed.

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' shortcode attribute in all versions up to and including 3.29.11. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user visits the page.

In the ash library, an Incorrect Authorization vulnerability widens a relationship's parent(...) scoping filter to match unintended records when the referenced parent field cannot be resolved. The unresolved reference defaults to nil, causing predicates like org_id == parent(org_id) to become IS NULL matches, and guards like is_nil(parent(org_id)) activate unrestricted branches, returning records that should be excluded. The fix fails the read with an error when a parent(...) reference cannot be resolved.

Incorrect authorization vulnerability in ash authorizes an aggregate under one read action while computing it under another, so an aggregate can run with policies that do not match the action it was authorized against. This can lead to disclosure of information about records the actor cannot read.

In the ash library, a Missing Authorization vulnerability allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. When an atomic strategy is used, the statement updates every row matched by primary key without applying policies, allowing modification of records belonging to other actors or tenants. The fix restricts the atomic path to data layers supporting changeset filters, authorizes each changeset, and merges the policy filter.

In the ash library, an Improper Access Control vulnerability lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because neither enforced primary-key uniqueness on insert. An actor who can set the primary key on a create can silently overwrite an existing record, destroying another entity's data without going through the update action or its policies. The fix rejects a create whose primary key already exists.

Not failing securely (failing open) vulnerability in ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. This can lead to security-relevant modifications being bypassed.

Uncontrolled resource consumption vulnerability in ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits for it. The AsyncLimiter.await_at_least_one/1 function used a tight loop with Task.yield(task, 0), causing busy-spinning.

In the ash library, an Uncontrolled Resource Consumption vulnerability lets an attacker exhaust node memory by matching a filter that spans multiple to-many relationships in memory. The flatten_relationships/2 function eagerly builds the full Cartesian product, leading to combinatorial memory growth. The fix streams the expansion lazily and short-circuits on the first matching scenario.

Improper validation of specified type of input vulnerability in ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that uses storage: :map_with_tag, bypassing that member's validation and any tag-based authorization. The dump_to_native/2 function did not force the configured tag, allowing a value with a tag naming a different member to be stored.

Vulnerability in the ash library involves improper input validation for attributes with doubly-nested arrays. Constraints on the outer array are not enforced, allowing invalid data to be accepted.

Vulnerability in the ash library discloses the stored value of a confirmed field to an attacker who fails the confirmation check. The atomic implementation of Confirm validation returns the stored field value in the error message.

In the ash library, an Improper Input Validation vulnerability allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. On read, the stored binary UUID does not match the expected format and returns an error, causing every subsequent read of that record to fail. The fix decodes any 16-byte stored binary directly in cast_stored/2.

In the ash library, an Integer Overflow or Wraparound vulnerability lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector with more than 65,535 elements. The element count is packed into a 16-bit field without range checking, causing wraparound modulo 65,536 and disagreement with the actual number of elements. The fix rejects any vector whose dimension exceeds 65,535.