CVE Vulnerability Catalog

Path Traversal vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows access to files outside the root directory.

SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.

Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Do Lasso up to version 358 allows an unauthenticated attacker to access objects without authorization.

Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.

Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.

Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.

Broken Authentication vulnerability in OAuth Single Sign On (SSO) (OAuth Client) versions up to 7.0.0 allows an unauthenticated attacker to bypass authentication mechanisms.

Unauthenticated Cross Site Scripting (XSS) in Business Directory versions up to 6.4.25. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist versions up to 2.9.1. An attacker can inject malicious script without authentication.

SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.

SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.

Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.

Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.

Unauthenticated privilege escalation in MStore API versions up to 4.20.0. An attacker can elevate privileges without authentication.

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce versions up to 2.11.31. An attacker can inject malicious script without authentication.

Unauthenticated SQL Injection in WP Directory Kit versions up to 1.5.4. An attacker can manipulate database queries without authentication.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Popup by Supsystic up to version 1.11.2 allows an unauthenticated attacker to inject malicious scripts.

Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms versions up to 4.3.3. An attacker can inject malicious script without authentication.

The Solace Extra plugin versions up to 1.6.0 have a broken access control vulnerability affecting subscribers. This means a low-privileged user may gain unauthorized access to certain functions or data.

The Car Rental Manager plugin versions up to 1.3.9 have a PHP Object Injection vulnerability exploitable by users with the editor role. An attacker can exploit this to execute malicious code on the server.