CVE Vulnerability Catalog

Payflex Payment Gateway plugin in versions up to and including 2.7.1 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

WPO365 plugin in versions up to and including 44.1 contains a Broken Access Control vulnerability exploitable by a subscriber-level attacker.

Xserver Migrator plugin in versions up to and including 1.6.6 contains a Sensitive Data Exposure vulnerability exploitable by an unauthenticated attacker.

A vulnerability was found in SourceCodester Simple Student Information System 1.0 in the file searchquery.php. Manipulation leads to SQL injection. The attack can be initiated remotely.

A vulnerability in Cloud Foundry UAA's OAuth token endpoint allows an authenticated attacker with a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as a Bearer credential on a client_credentials grant request. UAA fails to verify that the Bearer credential is actually a client credential, accepting any valid access token with a matching client_id.

Memory corruption occurs while processing service requests.

Memory corruption occurs when executing system service routines due to improper handling of user input buffers.

Memory corruption occurs when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.

Transient denial of service occurs when processing a continuous receive command with a zero-sized global configuration override.

Memory corruption occurs when processing draw objects of incorrect type during graphics command list execution.

Memory corruption occurs when accessing and modifying geographic mapping data concurrently without proper synchronization.

A cryptographic issue occurs when processing non-ELF partitions, where authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

Memory corruption occurs when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

A memory corruption vulnerability occurs when the non-secure loader rewrites page tables before secure memory initialization. This can corrupt memory structures used by security mechanisms.

A SQL Injection vulnerability was found in the Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL project in the file /admin_transaction.php, caused by manipulation of the Username argument. The attack can be performed remotely, and a public exploit is already available.

The ACPT (Premium) plugin for WordPress in versions up to and including 2.0.66 is vulnerable to Remote Code Execution via the render function. Missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates allow authenticated attackers with subscriber-level access and above to execute code on the server.

The Post SMTP plugin for WordPress in versions up to and including 4.0.1 is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user visits them.

The Sitemovr plugin in versions up to and including 1.0.1 allows an unauthenticated attacker to access sensitive data. No further technical details are provided in the description.

The WP Migration Plugin DB & Files – WP Synchro in versions up to and including 1.16.1 contains a subscriber bypass vulnerability. Technical details are not provided in the description.

The Fluent Affiliate Pro plugin in versions up to and including 1.6.4 is vulnerable to unauthenticated broken access control. Technical details are not provided in the description.