CVE Vulnerability Catalog

The AIWU content generator plugin contains a blind SQL injection vulnerability in versions up to and including 1.5.4. An attacker can exploit improper neutralization of special elements in SQL commands.

The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.

The Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) for WordPress contains a code injection vulnerability that allows remote code inclusion. The issue affects versions up to and including 5.2.0.

The Grand Photography WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 5.7.8.

The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code or manipulate data.

The AcyMailing SMTP Newsletter plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions up to and including 10.11.0.

The 777 triple-seven WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 1.13.0.

The Kirki plugin for WordPress contains a Blind SQL Injection vulnerability in versions up to and including 6.0.12. The issue is due to improper neutralization of special elements used in SQL commands.

The Kirki WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This affects versions up to and including 6.0.12.

The Aimogen Pro WordPress plugin contains an unrestricted file upload vulnerability with dangerous file types. This allows an attacker to upload malicious files, potentially leading to remote code execution.

The LatePoint plugin for WordPress contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects versions up to and including 5.6.3.

The WoowBot Pro Max WordPress plugin contains an unrestricted file upload vulnerability allowing dangerous file types. This enables an attacker to upload malicious files, potentially leading to remote code execution.

The Simple Business Directory Pro WordPress plugin contains an SQL injection vulnerability in versions up to and including 15.9.4. An attacker can exploit improper neutralization of special elements in SQL commands.

The Amelia WordPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects versions up to and including 2.4.2.

The SureDash WordPress plugin contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.8.0.

A URL path injection vulnerability via unencoded user-supplied identifiers has been found in Apache Gravitino. The issue affects versions from 1.0.0 before 1.2.1.

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. An attacker can remotely execute arbitrary system commands.

A vulnerability in a web server allows arbitrary file writes via a POST request to a specific endpoint. The endpoint accepts the filename parameter in the Content-Disposition header without verification, enabling overwriting of system files or shell scripts.

The vulnerability causes sensitive information such as passwords and charging card UIDs to be written to log files. This can lead to unauthorized access to this data by individuals with log access.

The firmware update mechanism lacks cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files, potentially leading to arbitrary code execution.