CVE Vulnerability Catalog

The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2. This is due to missing or incorrect nonce validation on the adminEnableGdprAjax() function. This makes it possible for unauthenticated attackers to modify GDPR settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers with subscriber-level access and above to submit refund requests for arbitrary orders that they do not own.

A vulnerability in the Meta Tag Manager WordPress plugin before version 3.3. It does not restrict which roles can create http-equiv refresh meta tags, potentially allowing unauthorized redirects.

The WordPress Welcart e-Commerce plugin (versions up to and including 2.11.22) is vulnerable to stored cross-site scripting (XSS) via the 'order_mail' setting due to insufficient sanitization of the order_mail field and lack of output escaping. An authenticated attacker with Editor-level permissions or above can inject arbitrary scripts via the General Setting page.

The NS Maintenance Mode for WP WordPress plugin through version 1.3.1 lacks authorization in its subscriber export function, allowing unauthenticated attackers to download a list of subscribers containing their names and email addresses.

Urządzenia Mercku M6a w wersji do 2.1.0 umożliwiają logowanie się jako root przez TELNET za pomocą hasła administratora webowego. To stwarza poważne zagrożenie dla bezpieczeństwa systemu.

On Mercku M6a devices through version 2.1.0, the authentication system uses predictable session tokens based on timestamps.

Mercku M6a devices through version 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.

On Mercku M6a devices through version 2.1.0, session tokens remain valid for at least months in some cases.

Urządzenia Mercku M6a w wersji do 2.1.0 umożliwiają zmianę hasła za pomocą ataków CSRF w intranecie. To stwarza ryzyko nieautoryzowanej zmiany haseł przez złośliwe podmioty.

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center do 2024-08-01 umożliwia wykonanie polecenia w ramach $( ) w danych JSON /center/api/installation/detection, co zostało wykorzystane w atakach w 2024 i 2025 roku.

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center do 2023-06-25 umożliwia przesyłanie plików poprzez wykorzystanie przejścia katalogowego w katalogu /center/api/files. Wykorzystanie tej podatności miało miejsce w 2024 i 2025 roku.

Vulnerability in Oracle Financial Services Analytical Applications Infrastructure (component: System Configuration) affecting versions 8.0.7.9, 8.0.8.7 and 8.1.2.5. An unauthenticated attacker with network access via HTTP can cause a hang or frequently repeatable crash (complete DoS).

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.12 and 7.2.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Vulnerability in Oracle VM VirtualBox (Core component) affects versions 7.1.12 and 7.2.2. A high-privileged authenticated attacker can exploit it locally, potentially leading to unauthorized access to critical data or all data accessible in VirtualBox.

Vulnerability in Oracle VM VirtualBox (Core component) affects versions 7.1.12 and 7.2.2. A high-privileged authenticated attacker can exploit it locally, potentially leading to unauthorized access to critical data or all data accessible in VirtualBox.

A vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions affected are 7.1.12 and 7.2.2. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in takeover of Oracle VM VirtualBox, and attacks may significantly impact additional products (scope change).

A vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions affected are 7.1.12 and 7.2.2. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in takeover of Oracle VM VirtualBox, and attacks may significantly impact additional products (scope change).

A vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions affected are 7.1.12 and 7.2.2. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise it. Successful attacks can result in takeover of Oracle VM VirtualBox, and attacks may significantly impact additional products (scope change).