CVE Vulnerability Catalog

There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.

The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.

Versions of SMS Alert Order Notifications up to 3.9.4 contain a vulnerability that allows subscriber privilege escalation.

Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.

There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.

In JobSearch versions up to 3.2.9, there is an unauthenticated SQL Injection vulnerability that can be exploited by an attacker to execute unauthorized queries against the database.

There is an unauthenticated PHP object injection vulnerability in JetEngine versions up to 3.8.10.

SigmaForms Pro – AI Generated Forms versions up to 1.4.5 contain a vulnerability allowing unauthenticated arbitrary file uploads.

A path traversal vulnerability in the SFTP provider allows a malicious or compromised remote SFTP server to write files outside the configured local destination directory. No Airflow account is required, and the attack surface includes any deployment downloading directories from an untrusted SFTP server.

There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.

Thrive Apprentice versions below 10.8.10.2 are vulnerable to unauthenticated PHP object injection.

JetEngine versions below 3.8.9.1 are vulnerable to unauthenticated SQL injection.

There is an unauthenticated SQL injection vulnerability in wpDataTables versions up to 7.3.6.

JetSearch versions up to 3.5.17 are vulnerable to unauthenticated SQL injection, potentially allowing unauthorized access to data.

The Crocoblock JetEngine plugin for WordPress up to version 3.8.9.1 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform Blind SQL Injection.

JetEngine versions up to 3.8.9.1 are vulnerable to PHP Object Injection, which may lead to unauthorized access to data.

LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.

There is an unauthenticated SQL Injection vulnerability in JetSmartFilters versions up to 3.8.1.

The Backpropagate library in versions 1.1.0 and 1.1.1 has a vulnerability that allows access to the user interface without authentication. This enables attackers to upload data, trigger training runs, and access models without any security.

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, an attacker could exploit a vulnerability in the Skool integration to forge a SUPERADMIN session, allowing impersonation of arbitrary organizations.