CVE Vulnerability Catalog

Unauthenticated Local File Inclusion in Resido <= 1.5 versions.

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

PHP Object Injection vulnerability in Flexible Subscriptions plugin versions up to and including 1.8.1. Allows an attacker to inject malicious PHP objects, potentially leading to unauthorized access or code execution.

Unauthenticated Broken Access Control vulnerability in Taxi Booking Manager for WooCommerce versions prior to 2.0.8. An attacker without authentication can exploit this to perform unauthorized actions.

Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.

Unauthenticated privilege escalation vulnerability in TrueBooker versions up to and including 1.2.6. An attacker without logging in can elevate privileges, e.g., to administrator level.

SQL Injection vulnerability in NGG Smart Image Search plugin versions prior to 4.0.0. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.

Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.

SQL Injection vulnerability in Maps Marker Pro plugin versions up to and including 4.32. An unauthenticated attacker can inject SQL queries, potentially leading to unauthorized database access.

Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping.

SQL injection vulnerability in Community by PeepSo plugin versions up to 9.0.5.2. An attacker with subscriber role can exploit this flaw to manipulate database queries.

Unauthenticated remote code execution (RCE) vulnerability in JetEngine plugin versions up to and including 3.8.14. An attacker can execute arbitrary code on the server without logging in.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Newsletter plugin versions up to 9.3.3. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Contest Gallery plugin versions up to 30.0.5. An attacker can inject malicious script without authentication.

SQL injection vulnerability in YITH WooCommerce Membership Premium plugin versions up to 2.33.0. An attacker with subscriber role can exploit this flaw to manipulate database queries.