CVE Vulnerability Catalog

Plack::Middleware::Statsd before version 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured, IP addresses may be leaked. Since version 0.9.0, the IP address is no longer logged by default, and if configured, an HMAC signature is logged instead.

WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the tab parameter. Attackers can craft URLs with XSS payloads in the tab parameter of the aawp-settings admin page to execute arbitrary JavaScript in the context of authenticated users.

Reflected XSS in the backend/mailingLog/manage module of uBidAuction 2.0.1 via unsanitized date_created, date_from, date_to, and created_at parameters, allowing remote attackers to inject malicious scripts via crafted GET requests.

A reflected XSS vulnerability exists in the auctions/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the tickets/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

The uBidAuction 2.0.1 plugin contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the posts/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the auctions/myAuctions/status/loose module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the auctions/myAuctions/status/active module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the orders/myOrders module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators visit the plugin settings page.

WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.

WordPress Contact Form Builder 1.6.1 contains a reflected XSS vulnerability that allows unauthenticated attackers to inject malicious scripts via the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers.

Reflected XSS in Jetpack plugin 9.1 for WordPress. Unauthenticated attacker can inject malicious script via the post_id parameter in the grunion-form-view.php endpoint.

The Drupal avatar_uploader module version 7.x-1.0-beta8 is vulnerable to Reflected XSS. An unauthenticated attacker can inject malicious scripts via the 'file' parameter in avatar_uploader.pages.inc.

The WordPress plugin amministrazione-aperta 3.7.3 has a local file read vulnerability allowing unauthenticated attackers to read arbitrary files via the open parameter in dispatcher.php due to insufficient input validation.

WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.

WordPress plugin cab-fare-calculator 1.0.3 has a local file inclusion vulnerability. Unauthenticated attackers can read arbitrary files by manipulating the controller parameter in tblight.php with path traversal sequences.

Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting payloads in accommodation type fields. Attackers can inject script tags through the title and excerpt parameters when creating accommodation types, which execute in the browser when visitors access the accommodations page.

Stored XSS in Testimonial Slider and Showcase plugin 2.2.6 for WordPress. Authenticated editors can inject malicious script via the post_title field, which executes for other users.