CVE Vulnerability Catalog

A vulnerability was identified in itsourcecode Online Admission System 1.0. It impacts an unknown function in the file /admin/schoolyear.php. Manipulation of the sy argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was detected in vgmstream up to r2117. The function ps_find_padding in the file src/coding/psx_decoder.c of the VAG File Handler component is affected. Manipulation results in an out-of-bounds read. The attack can be carried out remotely. A patch is available.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS. This issue affects QR Redirector from n/a through 2.0.5.

An Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data. This issue affects Events Manager from n/a through 7.4.5.

A Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter Injection. This issue affects the plugin from n/a through 2.0.22.

A Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Admin Audit from n/a through 1.2.17.

Stored XSS vulnerability in Logo Showcase plugin up to version 4.0.4. An attacker can inject a malicious script that executes in the administrator's browser.

Stored XSS vulnerability in eCommerce Product Catalog plugin up to version 3.6.2. Allows injection of a persistent script that can execute in the user's browser context.

Missing authorization in WP Mailster plugin up to version 1.9.0.0. Allows exploitation of incorrectly configured access control security levels.

Path traversal vulnerability in DigitalCanion's management portal, in the Maintenance → System Logs functionality. Allows access to files outside the intended directory, including sensitive system files.

Missing authorization in Event Tickets plugin up to version 5.30.0. Allows exploitation of incorrectly configured access control security levels.

Stored XSS vulnerability in MP3 Audio Player by Sonaar plugin up to version 5.14.2. Allows injection of a persistent script that can execute in the administrator's browser.

Stored XSS vulnerability in Image Photo Gallery Final Tiles Grid plugin up to version 3.6.13. Allows injection of a persistent script that can execute in the user's browser.

Stored XSS vulnerability in GiveWP plugin up to version 4.17.0. Allows injection of a persistent script that can execute in the administrator's browser.

Exposure of sensitive system information vulnerability in Memberful - Membership Plugin up to version 1.81.2. Allows retrieval of embedded sensitive data.

Stored XSS vulnerability in B Blocks plugin up to version 2.1.8. Allows injection of a persistent script that can execute in the administrator's browser.

The Name Directory WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.34.2.

The Name Directory WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 1.34.2.

The PowerPress Podcasting WordPress plugin contains a missing authorization vulnerability that allows retrieving embedded sensitive data. The issue affects versions up to and including 11.17.9.

The WP VR WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 9.1.3.