CVE Vulnerability Catalog

The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.3. Missing nonce verification in the options() function allows unauthenticated attackers to trick an administrator into clicking a link or visiting a malicious page, resulting in unauthorized changes to plugin settings (e.g., unit preferences) persisted in the database.

The General Options plugin for WordPress up to version 1.1.0 uses sanitize_text_field() for output in the Contact Number field, which does not encode double quotes. This allows administrators to inject JavaScript scripts in settings that execute whenever the settings page is visited.

Stored XSS vulnerability in the 'cvmh-sticky' shortcode of the Sticky plugin for WordPress via the 'readmoretext' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.

The Word 2 Cash plugin for WordPress up to version 0.9.2 is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. Lack of nonce verification, input sanitization, and output escaping allows unauthenticated attackers to forge requests on behalf of an admin and store arbitrary JavaScript payloads.

The Nexa Blocks plugin for WordPress up to version 1.1.1 is vulnerable to Server-Side Request Forgery (SSRF) due to missing URL validation in the import_demo() function. The function accepts a user-supplied URL in the demo_json_file POST parameter and passes it directly to wp_remote_get() without restrictions. Additionally, the AJAX nonce is publicly exposed in frontend HTML, allowing unauthenticated attacks.

The Sentence To SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0. Missing nonce validation on the create_admin_page() function allows unauthenticated attackers to inject malicious scripts and update plugin settings via a forged request, provided they trick a site administrator into clicking a link.

The Oliver POS plugin for WordPress up to version 2.4.2.6 has an authorization bypass vulnerability. The REST API authentication uses loose PHP comparison (==) for the 'OliverAuth' header. On fresh installations where the token option is unset, '0' == false evaluates to true, allowing unauthenticated full API access.

The Diagnosis Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. Missing authorization checks and insufficient input sanitization in the themeFunc() function allow any authenticated user (including subscribers) to save malicious JavaScript to theme files.

In rsync version 3.4.2 and prior, a receiver-side out-of-bounds array read vulnerability exists in recv_files() in receiver.c. A malicious rsync server can crash the rsync client by sending a specially crafted file list, causing a deterministic SIGSEGV.

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Microsoft confirmed a Windows vulnerability called 'YellowKey' that bypasses security features. Proof of concept has been published. Users with TPM+PIN are not affected. Microsoft provided temporary mitigations.

Trilium Notes versions 0.102.1 and prior contain a vulnerability to TCC bypass via prompt spoofing in the Electron configuration. A local attacker can run malicious code under the trusted app's identity using the RunAsNode flag to execute arbitrary system commands, leading to misleading macOS permission prompts and access to protected resources.

Trilium Notes versions up to 0.102.1 are vulnerable to Local File Inclusion (LFI). An authenticated attacker can read arbitrary files from the server's filesystem via the uploadModifiedFileToAttachment function.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This is fixed in version 2.28.2.

Mantis Bug Tracker (MantisBT) versions up to 2.28.1 allow an authenticated user to upload attachments to private issues they are not authorized to access.

The Colorbox Inline module for Drupal is vulnerable to Cross-Site Scripting (XSS) in all versions before 2.1.1. The vulnerability is due to improper neutralization of input during web page generation.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Obfuscate allows Cross-Site Scripting (XSS). This issue affects Obfuscate: from 0.0.0 before 2.0.2.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

Improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affects versions from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7.