CVE Vulnerability Catalog

In the Zoo extension for Joomla (versions < 4.1.65), the comment controller endpoint lacks ACL checks, allowing unauthenticated users to modify tags without authorization.

A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.

An unauthenticated remote attacker can retrieve sensitive files from the FDS Web server, such as the backup archive at `/FdsBackup.zip` and files under `/downloads/*`, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information.

A low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.

An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.

A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.

A low-privileged remote attacker can hijack an active administrative session without knowing the admin password by extracting plaintext session identifiers from downloadable error logs.

A high-privileged remote attacker can upload a malicious ZIP with directory traversal sequences, escaping the extraction directory and writing files to arbitrary locations, potentially achieving code execution.

A high-privileged remote attacker can upload a .php file and request it directly from /uploads to achieve arbitrary code execution due to improper file type validation.

The Joomla extension Phoca Download versions 5.0.0-6.1.4 contains a Reflected XSS vulnerability via the 'search' GET parameter.

The Joomla extension Phoca Cart versions 5.0.0-6.1.7 contains a Reflected XSS vulnerability via the 'price_from' and 'price_to' filter parameters.

Joomla extension Phoca Cart 5.0.0-6.1.7 has a stored XSS vulnerability via User-Agent header in the admin order view.

Joomla extension iCagenda 4.0.8 to 4.0.12 has an authenticated stored XSS in the 'Submit an Event' form, where image and file fields are stored without output-side HTML-attribute escaping.

An OS command injection vulnerability in vsDesk allows an authenticated attacker with admin privileges to execute arbitrary OS commands due to insufficient input filtering.

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in, unintended operations may be performed.

In affected versions of Octopus Server, sensitive variables may be printed in clear-text in the deployment variable snapshot under certain circumstances.

The application generates uploaded file names using a weak and predictable method based on the request timestamp. A remote attacker can guess or brute-force the filename within a short time window, access uploaded files, and facilitate further attacks.

The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.

The JSON Options WordPress plugin through 0.0.4 lacks capability checks and nonce verification on one action, available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

The Kirki WordPress plugin before 6.2.3 does not properly validate files in archives uploaded by users with the Editor role and does not remove all unwanted files after extraction, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS and RCE on some server configurations.