CVE Vulnerability Catalog

Insecure Direct Object Reference (IDOR) vulnerability in DeporSite by T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in '/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos', which could lead to the exposure or alteration of confidential data.

A vulnerability was identified in macrozheng mall-swarm up to version 1.0.3 in the updateAttr function of the file /cart/update/attr. Manipulation leads to improper authorization. The attack can be performed remotely, and the exploit is publicly available.

A Reflected Cross-site Scripting (XSS) vulnerability has been discovered in xCally's Omnichannel v3.30.1. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the 'failureMessage' parameter in '/login'. This can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow. An attacker can inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data, leading to a DoS attack.

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability when running in server mode and performing restores from PLAIN-format dump files. Attackers can inject and execute arbitrary commands on the server hosting pgAdmin.

The Envira Photo Gallery plugin for WordPress up to version 1.12.0 is vulnerable to unauthorized data modification due to missing capability checks in several functions. Authenticated attackers with Author-level access or above can perform multiple actions, such as removing images from arbitrary galleries. The vulnerability was partially patched in version 1.12.0.

The Supermicro BMC Insyde SMASH shell program contains a stack-based overflow vulnerability.

The JetFormBuilder plugin for WordPress up to version 3.5.3 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Stored Cross-Site Scripting (XSS) vulnerability in Qi Blocks (versions up to 1.4.3). Allows an attacker to inject a persistent script that executes in the victim's browser.

The Order Export & Order Import plugin for WooCommerce has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.6.7.

The Booking Calendar plugin (by wpdevelop) is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects Booking Calendar versions from n/a through <= 10.14.7.

Stored Cross-Site Scripting (XSS) vulnerability in Booster for WooCommerce (versions up to 7.3.2). Allows an attacker to inject a persistent script that executes in the victim's browser.

Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booster for WooCommerce: from n/a through <= 7.4.0.

The YOP Poll plugin for WordPress has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects YOP Poll from n/a through <= 6.5.38.

The Contact Form Email plugin (codepeople) in versions up to and including 1.3.58 has a missing authorization vulnerability resulting from incorrectly configured access control security levels.

The Analytics Germanized for Google Analytics (ga-germanized) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.6.2. The vulnerability is due to improper neutralization of input during web page generation.

Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ChatBot from n/a through <= 7.3.9.

The WordPress plugin Survey Maker (survey-maker) by Ays Pro contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 5.1.9.4.