CVE Vulnerability Catalog

The Support Genix plugin (up to version 1.4.54) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.

The Electronic Signature Add-on for Fluent Forms plugin (up to version 2.0.5) has an authorization bypass through user-controlled key vulnerability. This allows exploiting incorrectly configured access control security levels.

The Simply Schedule Appointments plugin (up to version 1.6.12.35) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets stored and executed.

The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.

The Booktics plugin (up to version 1.0.29) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets executed in the victim's browser.

The eStore plugin for WordPress (up to version 1.6.13) is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. An attacker can inject malicious JavaScript that executes in the victim's browser.

The Strong Testimonials plugin for WordPress (up to version 3.3.12) is vulnerable to deserialization of untrusted data, allowing Object Injection. An attacker can supply malicious data that gets deserialized by the application.

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement. This allows authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer. This allows them to escalate any account to administrator and take over the site.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The vulnerability affects the functions MySQLDB::valid, MySQLDB::getresults, MySQLDB::noresults, MySQLDB::getExams, MySQLDB::latestExamID, and MySQLDB::getreport in results.php and include/database.php. Manipulation of the id, user, or topic arguments leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The vulnerability affects an unknown function in qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Manipulation of the query, qtype, sortname, or sortorder arguments leads to SQL injection, and the attack can be launched remotely. The exploit has been made publicly available and could be used for attacks.

A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. The vulnerability affects the cache/del_cache/arr2sql function in func.php. Manipulation leads to SQL injection, and the attack can be launched remotely. The reported GitHub issue was closed as "completed", but it was not possible to determine the PR or commit that fixed it.

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing administrative access and accountability.

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.