CVE Vulnerability Catalog

The WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin versions <= 1.2.2 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor+ privileges.

The QualityUnit Post Affiliate Pro plugin versions <= 1.25.0 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).

The SuiteDash Direct Login plugin in versions up to 1.7.6 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the victim's browser context.

The Elastic Email Sender plugin versions <= 1.2.6 has a stored Cross-Site Scripting (XSS) vulnerability with authentication (admin+).

A vulnerability has been identified in MXsecurity versions prior to v1.0.1 that may lead to pollution of the sqlite database and the nsm-web interface. An unauthenticated attacker could register or add devices via the nsm-web application.

The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'fa' and 'fa-stack' shortcodes in versions up to and including 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes.

A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler, leading to information disclosure.

A critical vulnerability has been found in IBOS OA version 4.5.5, affecting the addComment function in the file ?r=weibo/comment/addcomment. Manipulation of the touid argument leads to SQL injection.

A critical vulnerability was found in Xintian Smart Table Integrated Management System version 5.6.9, affecting an unknown part of the file /SysManage/AddUpdateRole.aspx. Manipulation of the argument txtRoleName leads to SQL injection.

A critical vulnerability has been found in D-Link DAR-8000-10 up to version 20230819, related to argument manipulation in the file /log/decodmail.php, leading to OS command injection.

A vulnerability was found in TOTVS RM 12.1 that allows cross site scripting through manipulation of the argument 'd' in the Portal component. The attack can be launched remotely.

In XWiki Platform, it is possible to execute Velocity code without having script rights by creating an XClass with a property of type 'TextArea' and content type 'VelocityCode' or 'VelocityWiki'. In both cases, the code is executed regardless of the rights of the property author, which may lead to unauthorized access to data and APIs.

Version 0.95 of Catdoc was found to contain a NULL pointer dereference vulnerability in the xls2csv component at src/fileutil.c.

A critical vulnerability was found in Infosoftbd Clcknshop 1.0.0, affecting unknown processing of the file /collection/all in the GET Parameter Handler component. Manipulation of the argument tag leads to SQL injection.

Multiple cross-site scripting (XSS) vulnerabilities in the inventory management system version 1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add New Member section.

Integer overflow or wraparound exists in the GitHub repository gpac/gpac prior to version 2.3-DEV.

There is an out-of-bounds read vulnerability in the GitHub repository gpac/gpac prior to version 2.3-DEV.

In the GitHub repository gpac/gpac prior to version 2.3-DEV, there is a floating point comparison bug using an incorrect operator.

SQL Injection vulnerability in Chamilo LMS versions 1.11 through 1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions.

Multiple cross-site scripting (XSS) vulnerabilities in the Inventory Management System v1.0 allow attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name, Address, and Company parameters under the Add Customer section.