CVE Vulnerability Catalog

Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.

Stored XSS vulnerability in the Quiz And Survey Master plugin by ExpressTech. Improper input neutralization during page generation allows persistent execution of malicious scripts.

The Booktics plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.0.27.

The Hustle plugin (versions up to and including 7.8.14.2) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Hustle from n/a through 7.8.14.2.

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79).

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The attack requires 'trusted_jar_paths' to have a non-empty value configured by the Impala admin.

A vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.

The Joomla extension OrdaSoft Touch Slider (before 5.4.6) has an unauthenticated destructive CRUD vulnerability. The function modOsTouchSliderHelper::getAjax() is the single handler for data operations, with no user check, authorization, or CSRF token. An unauthenticated attacker can delete slider images and replace entire database tables.

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

Vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to write files to arbitrary locations when an administrator installs it.

A flaw in the SMTP email configuration handling of the keycloak-services component. When STARTTLS is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing fallback to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic could capture sensitive email credentials and message content in plain text.

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.

The Optimole WordPress plugin before version 4.2.15 does not perform a capability check before exposing stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

The MetForm WordPress plugin before version 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.

The WordPress plugin WPCafe (before 3.0.21) does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.

The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).

The MPG WordPress plugin before version 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.

The Animated Number Counters WordPress plugin before version 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.