CVE Vulnerability Catalog

CubeWP plugin versions up to 1.1.30 contain a SQL Injection vulnerability from subscriber level. A user with subscriber role can inject malicious SQL queries.

Service Finder Booking plugin versions up to 6.2 contain a Subscriber Privilege Escalation vulnerability. A user with subscriber role can gain higher privileges.

Broken Access Control vulnerability in Service Finder Booking up to version 6.2 allows a subscriber to gain unauthorized access to administrative functions.

Unauthenticated Cross Site Scripting (XSS) in Do Lasso versions up to 358. An attacker can inject malicious script without authentication.

Path Traversal vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows access to files outside the root directory.

SQL Injection vulnerability in Do Lasso versions up to 358, exploitable by Subscriber role. Allows manipulation of database queries.

Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Do Lasso up to version 358 allows an unauthenticated attacker to access objects without authorization.

Unauthenticated PHP Object Injection vulnerability in Headless Single Sign On versions up to 1.6. An attacker can inject malicious PHP objects without authentication.

Unauthenticated Bypass Vulnerability in Headless Single Sign On versions up to 1.6. An attacker can bypass security mechanisms without authentication.

Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.

Broken Authentication vulnerability in OAuth Single Sign On (SSO) (OAuth Client) versions up to 7.0.0 allows an unauthenticated attacker to bypass authentication mechanisms.

Unauthenticated Cross Site Scripting (XSS) in Business Directory versions up to 6.4.25. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist versions up to 2.9.1. An attacker can inject malicious script without authentication.

SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.

SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.

Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.

Remote Code Execution (RCE) vulnerability in QA Analytics versions up to 5.2.0.0 allows an unauthenticated attacker to execute arbitrary code on the server.

Unauthenticated privilege escalation in MStore API versions up to 4.20.0. An attacker can elevate privileges without authentication.

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce versions up to 2.11.31. An attacker can inject malicious script without authentication.

Unauthenticated SQL Injection in WP Directory Kit versions up to 1.5.4. An attacker can manipulate database queries without authentication.