CVE Vulnerability Catalog

The Advanced Ads plugin (up to version 2.0.26) has an Authorization Bypass Through User-Controlled Key vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit a user-controlled key to bypass authorization.

The All in One SEO plugin for WordPress up to version 5.0.1.1 is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject scripts. Exploitation requires the victim to have aioseo_manage_seo capability and open the SEO Preview panel.

The Repasat application has a Cross-Site Scripting vulnerability in the nomTipoCli parameter at the /es/clientypes/update/109441 endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Repasat application has a Cross-Site Scripting vulnerability in the nomGrupoEmpresarial parameter at the /es/corporategroups/update/246 endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Repasat application has a Cross-Site Scripting vulnerability in the nomMotivo parameter at the /es/lostmotives/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.

The Repasat application has a Cross-Site Scripting vulnerability in the nomServicioPrestado parameter at the /es/providedservices/store endpoint. An attacker can trick a user into executing arbitrary code in the browser.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomDelegacion' at endpoint '/es/delegations/store'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomCompetidor' at endpoint '/es/competitors/store'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomRuta' at endpoint '/es/routes/update/693'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomTransportista' at endpoint '/es/carriers/update'.

Cross-Site Scripting (XSS) vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The affected parameter is 'nomZonaGeo' at endpoint '/es/geozones/update/149979'.

Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows exploiting incorrectly configured access control security levels. This issue affects LearnPress from n/a through 4.4.9.

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could trick a user into opening content that embeds or references a specially crafted CID-keyed font, causing repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

cjbassi/gotop is vulnerable to local argument injection via its process termination functionality. The process name is passed directly to pkill without sanitization, so a local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. The product is no longer actively supported and the vulnerability has not been fixed; it was confirmed at version 3.0.0.

Server-Side Request Forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects versions before 2.1. Note: The vendor was contacted and it was learned that the product is not supported.

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects versions before 2.1. Note: The vendor was contacted and it was learned that the product is not supported.

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The endpoint "/es/datatables/getemployeetypesdatatable" is affected.

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "nomListaValidacion" parameter is affected – endpoint "/es/validationslists/assignList/Employee/45659".

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "name" parameter is affected – endpoint "/es/attachmenttypes/update/203336".

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.