CVE Vulnerability Catalog

An unauthenticated Cross Site Scripting (XSS) vulnerability in Super Store Finder versions up to and including 7.10.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Tailored Tools versions up to and including 3.0.2.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Email Essentials versions up to and including 6.0.6.

An unauthenticated SQL Injection vulnerability was detected in Throws SPAM Away versions up to 3.8.2. This vulnerability may allow an attacker to manipulate database queries.

Broken Access Control vulnerability in Booking and Rental Manager up to version 2.7.6. Subscriber-level users can gain unauthorized access to functionality.

Broken Access Control vulnerability in OwnerRez API up to version 1.2.6. Subscriber-level users can gain unauthorized access.

An unauthenticated SQL Injection vulnerability was detected in Smart Marketing SMS and Newsletters Forms versions up to 5.1.24. This vulnerability may allow an attacker to manipulate database queries.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector versions up to 4.0.5.

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack versions up to 6.2.12.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack versions up to 6.2.12.

An unauthenticated SQL Injection vulnerability was detected in WP Data Access versions up to 5.5.81. This vulnerability may allow an attacker to manipulate database queries.

Unauthenticated Cross Site Scripting (XSS) in Uncode theme versions up to 2.12.7.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.

Subscriber SQL Injection in Charitable versions up to 1.8.12.1.

Sensitive Data Exposure vulnerability in Print Barcode Labels for your WooCommerce products/orders up to version 4.0.0. Subscriber-level users can access sensitive data.

Missing Authorization vulnerability in Post SMTP from 4.0.0 through beta.1. Allows exploiting incorrectly configured access control security levels.

FastGPT Community Edition versions 4.10.0 through 4.14.0 are vulnerable to NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.

MetaGPT version 0.8.1 contains an OS command injection vulnerability. An attacker can execute arbitrary commands via the 'path' argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.

Kirby is an open-source content management system. Prior to versions 4.9.5 and 5.5.2, the media handler in src/Cms/Media.php allowed Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.