CVE Vulnerability Catalog

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request.

A vulnerability was discovered in NASA cFS up to 7.0.1, affecting the CFE_SB_GetUserDataLength function in cfe_sb_util.c of the cFE Software Bus component. Manipulating TotalMsgSize/HdrSize results in integer underflow. The attack can be initiated remotely, and the vendor did not respond.

A vulnerability was identified in NASA cFS up to 7.0.1, affecting the OS_read function in sbn_tcp_if.c of the SBN TCP Module. Manipulating the MsgSz argument leads to buffer overflow. The attack must be carried out from within the local network. The vendor did not respond.

A vulnerability was found in NASA Trick 19.6.0 in the function JSONVariableServerThread::parse_request in the file trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp, part of the TCP Socket Handler component. Manipulation causes a stack-based buffer overflow. The attack can be carried out remotely.

The MyHome Core plugin for WordPress up to version 4.4.5 contains an authentication bypass vulnerability. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This allows unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators.

The ash_sqlite library (ash-project) has an improper neutralization of special elements in data query logic vulnerability. An attacker who controls a get_path/2 segment can traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. This happens because the JSON path is built by concatenating segments without proper escaping.

The oidcc library (erlef) has an improper verification of cryptographic signature vulnerability. An unauthenticated attacker can impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. The library accepts a JWE wrapping unsigned claims as fully validated, allowing minting tokens with arbitrary sub, iss, and aud without the provider's signing key.

A vulnerability in the qs library allows bypassing the arrayLimit for comma-separated values when comma: true and throwOnLimitExceeded: true are used. This affects bracket-push keys (a[]=), where the value is split into an array without checking the limit, enabling allocation of arbitrarily large arrays. The issue affects versions >=6.14.2 <6.16.0 and is fixed in 6.16.0.

The ash_paper_trail library (ash-project) has a cleartext storage of sensitive information vulnerability. An attacker with read access to the generated version resource can recover sensitive values nested inside embedded resources, unions, or lists. The sensitive_attributes :redact and :ignore only act on top-level attributes, not descending into nested structures.

The ash_paper_trail library (ash-project) has an inefficient algorithmic complexity vulnerability. A user who can submit a large array attribute to a paper-trailed create or update action can cause a denial of service through excessive CPU and memory use. This results from cubic scaling of list comparison operations in full-diff mode.

The ash_paper_trail library (ash-project) has a cleartext storage of sensitive information vulnerability. An attacker with read access to the generated version resource can recover the plaintext of sensitive? attributes. These values are stored in the changes map, which is public and not marked as sensitive, so they are returned by the default read action and printed in logs and error messages.

The `qs.stringify` function in the qs library throws a `TypeError` when serializing an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. The duck-typing check in `utils.isBuffer` invokes `obj.constructor.isBuffer(obj)` without verifying it is a function, causing the error. Affected versions are from 2.2.5 to 6.15.3, fixed in 6.16.0.

In PHPGurukul Student Information System 1.0, a SQL injection vulnerability exists in the file /student_edit1.php via manipulation of the ID argument. The attack can be launched remotely, and the exploit is publicly available.

In macrozheng mall up to 1.0.3, a vulnerability exists in the Payment Status Endpoint component, in the file /order/paySuccess, where manipulation of the orderId argument leads to enforcement of behavioral workflow. The attack can be carried out remotely. The vendor deleted the GitHub issue without explanation.

In itsourcecode Sales and Inventory System 1.0, a SQL injection vulnerability exists in the file /pages/emp_del.php via manipulation of the ID argument. The attack may be launched remotely, and the exploit has been released to the public.

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0, affecting the file /pages/emp_edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit is publicly available.

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator as the desired role.