CVE Vulnerability Catalog

The TrueBooker WordPress plugin before 1.3.0 does not have authorization checks in some of its AJAX actions and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it checks is issued to unauthenticated visitors. This allows anyone to overwrite the plugin's entire configuration and discard any settings they do not supply.

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid. This allows unauthenticated users to mark any unpaid order as paid and rewrite its total.

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state. This allows unauthenticated users to replace the thumbnail image the site publishes for any document.

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup. This allows users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.

A security vulnerability has been detected in Dav-ee dairy-management-system in the mysqli_query function of the employees/delete.php file. Manipulation of the e_payroll_no argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used; the project has not yet responded to the report.

A weakness has been identified in Dav-ee dairy-management-system in the mysqli_query function of the farmers/add.php file. Manipulation of the f_no/f_id/f_name/f_locallity/f_ac/f_phone arguments can lead to SQL injection, and the attack can be launched remotely. The exploit is publicly available, and the product does not use versioning, so version information is unavailable.

A weakness has been identified in itsourcecode Online Cake Ordering System 1.0 in the confirm.php file. Manipulation of the cancel argument causes SQL injection, and the attack can be initiated remotely. The exploit is publicly available and could be used for attacks.

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify credentials on its public payment-status update route and treats unset credentials as valid. This allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret. This allows unauthenticated attackers to forge notifications that mark arbitrary orders as paid or cancel already-paid orders.

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without completing payment.

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads. Unauthenticated users can bypass the payment requirement and retrieve any product's paid downloadable file.

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers. Users with subscriber-level access and above can overwrite the plugin's stored settings, including stored API credentials and feature and template configuration.

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory. Unauthenticated attackers can read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify the RMC filesystem.

A vulnerability in ESPnet up to 202610.post2 affects the build_model function in espnet3/publication/inference_model.py of the Inference Model Handler component. Manipulation of the _target_ argument results in deserialization, and the attack can be launched remotely. The exploit has been made public, and the patch is identified as f217b24f06de55e332cab10231469d5890dbbe00.

A security flaw in sgl-project SGLang up to 0.5.19 affects the WeightExporter.send_weights_to_remote_instance function in python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the Weight Exporter component. Manipulation of the group_name argument results in denial of service, and the attack can be initiated remotely. The exploit has been released to the public, and the pull request to fix this issue awaits acceptance.

A vulnerability was found in HanLP up to 2.1.0-beta.64 in the hanlp.load function of reflection.py, related to model config loading. Manipulating the classpath argument causes deserialization, enabling remote attacks. The exploit has been publicly disclosed and the project has not yet responded.

A vulnerability in the domain creation functionality of SME Server 11.0rc1-215 allows an attacker with high privileges to inject reserved Apache configuration directives. This corrupts httpd.conf and prevents Apache from starting after a reboot, causing a denial-of-service (DoS) condition affecting the web server and hosted virtual hosts.