CVE Vulnerability Catalog

The CRM Perks Contact Form Entries plugin versions <= 1.3.0 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.

The WP-Matomo Integration (WP-Piwik) plugin versions up to 1.0.27 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

The Ciprian Popescu YouTube Playlist Player plugin versions up to 4.6.4 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The PluginOps MailChimp Subscribe Form plugin versions up to 4.0.9.1 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users visiting the site.

The Smart App Banner plugin in versions up to 1.1.2 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The BEAR plugin in versions <= 1.1.3.1 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

CSRF vulnerability in Crocoblock JetFormBuilder plugin versions <= 3.0.6 allows attackers to perform unauthorized actions on behalf of users.

The WooDiscuz – WooCommerce Comments plugin has a stored XSS vulnerability that can be exploited by users with admin privileges. This issue affects versions from n/a to 2.2.9.

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6.

Omni-notes is a note-taking application for Android that had a path validation vulnerability. This vulnerability allowed malicious applications to copy files from internal storage to external storage, potentially leading to unauthorized data access.

The vulnerability in Rekor allows a malformed entry of type `intoto/v0.0.2` to cause a panic in a thread within the Rekor process. However, the service continues to run, and the client receives a 500 error message.

In the Linux kernel, a NULL pointer dereference flaw exists in f2fs_write_end_io in fs/f2fs/data.c. The flaw allows a local privileged user to cause a denial of service.

Craft is a content management system (CMS) for creating custom digital experiences. A cross-site scripting (XSS) vulnerability can be triggered by review volumes. This issue has been fixed in version 4.4.7.

Highlight is an open-source monitoring platform that may record passwords when an HTML password input is switched to `type="text"` via a JavaScript 'Show Password' button. This behavior differs from the expected one that always obfuscates `password` type inputs.

Django-SES is a mail backend for Django that implements support for AWS Simple Email Service. The django_ses library had a flaw in verifying AWS request signatures, allowing users to specify arbitrary public certificates.

An improper certificate validation vulnerability in curl < v8.1.0 exists in the way it matches wildcard patterns in the Subject Alternative Name of TLS server certificates. curl's private wildcard matching function incorrectly matches IDN hostnames, potentially accepting patterns that should mismatch.

A denial of service vulnerability in curl < v8.1.0 exists in the way libcurl provides different backends for resolving host names. With the synchronous resolver, name resolves can time-out slow operations using alarm() and siglongjmp(), and libcurl used a global buffer not protected by a mutex, so a multi-threaded application might crash or misbehave.

An issue was discovered in Papaya Viewer version 1.0.1449 related to the lack of input sanitization. User-supplied DICOM or NIFTI images can be loaded, allowing arbitrary JavaScript code injection into image metadata, which is executed when that metadata is displayed.

Craft is a content management system (CMS) for creating custom digital experiences on the web. A cross-site scripting (XSS) vulnerability has been identified that can be triggered via the Update Asset Index utility. This issue has been patched in version 4.4.6.

A NULL pointer dereference was found in libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.