CVE Vulnerability Catalog

The SKT Addons for Elementor plugin in versions up to and including 4.0 contains an Editor SQL Injection vulnerability. This enables an editor-level user to inject malicious SQL code into database queries.

The WC Vendors Marketplace plugin in versions up to and including 2.7.2.1 contains an Administrator SQL Injection vulnerability. This allows an administrator-level user to inject malicious SQL code into database queries.

The WordPress plugin WPMasterToolKit in versions up to 2.22.0 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Newsletters in versions up to 4.18 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin WP Maps in versions up to 4.9.9 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.

The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.

The password reset functionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership.

The admin3 application through version 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.

The admin3 application through version 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed.

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string) because GravExtension::assertSandboxDumpSafe() checks sandbox state without a Source argument, so the guard never executes. An authenticated user with page-edit rights can render {{ config|print_r }} and dump Grav's entire merged configuration, exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords.

In Grav (a flat-file CMS) versions 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: true, which is not the default), the Clockwork profiler endpoint at /__clockwork/ is exposed without authentication. Because the shipped default is censored: false, stored records contain raw session cookies, plaintext login credentials, and the full system and plugin configuration including operator secrets. The issue is fixed in 1.7.53.4 and 2.0.22.

WWBN AVideo through commit e01e41ecc contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement, takes users_id directly from the query string and calls User::sendVerificationLink() with no session, CSRF token, relationship check or rate limit, allowing an unauthenticated attacker to send unlimited verification emails, enumerate accounts and write password-recovery tokens onto victim accounts.

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code mainly from uniqid(), reducing the code space to roughly 36 x 10^6 values for a known generation second, and an unauthenticated attacker can guess a valid code and gain account access.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.