CVE Vulnerability Catalog

PHP Object Injection vulnerability in the N7 | Golf Club Sports & Events theme in versions up to and including 2.21. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Invetex theme in versions up to and including 2.18. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Law Office theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the WineShop theme in versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in the Equadio theme in versions up to and including 1.1.4. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The vulnerability stems from a lack of input validation.

PHP Object Injection vulnerability in Juno versions up to and including 2.25. An unauthenticated attacker can inject a malicious PHP object, potentially leading to further exploitation. The issue affects unauthenticated access.

PHP Object Injection vulnerability in Avala versions up to and including 1.1.4. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Kalles versions up to and including 1.1.7.1. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Yacht Rental versions up to and including 2.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Wine House versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Tipsy versions up to and including 1.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Stargaze versions up to and including 1.10. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Splendour versions up to and including 1.23. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

Local File Inclusion vulnerability in DirectoryPress versions up to and including 3.6.27. An unauthenticated attacker can include local files, potentially leading to information disclosure or code execution. The issue affects unauthenticated access.

SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.

The Tailored Tools plugin in versions up to and including 3.0.3 contains an unauthenticated arbitrary file upload vulnerability. The lack of required authorization allows exploitation without an account in the application.

The CodeBard Help Desk plugin in versions up to and including 1.1.2 contains an arbitrary file upload vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required, greatly easing exploitation.

The Tonda Membership plugin in versions up to and including 1.0.1 contains an unauthenticated privilege escalation vulnerability. The lack of required authorization allows exploitation without an account.

The CleanSkin plugin in versions up to and including 1.5.0 contains a PHP Object Injection vulnerability exploitable by an unauthenticated attacker. The lack of required authorization allows exploitation without an account.

The Dynamic User Directory plugin in versions up to and including 2.4 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.