CVE Vulnerability Catalog

A vulnerability has been found in itsourcecode Leave Management System 1.0. An unknown function in /module/leavetype/controller.php allows manipulation of the LEAVTID argument leading to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability exists in Form Tools up to 3.1.1 in the smart_fill function of /global/code/actions.php (AJAX Endpoint component). Manipulation of the url argument allows server-side requests. The exploit is publicly disclosed and can be triggered remotely.

An unrestricted file upload vulnerability exists in Form Tools up to 3.1.1 in the Files::uploadFile function of global/code/actions.php (Ajax Handler component). Manipulation allows remote upload of arbitrary files. The exploit is public and may be used.

A vulnerability exists in Form Tools up to 3.1.1 in the Clients::updateClientSettingsTab function of global/code/Clients.class.php (Client Settings component). Manipulation of the page_titles argument leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely and the exploit is publicly disclosed.

The WP Popular Posts plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 7.4.2 via the 'context' parameter. Unauthenticated attackers can extract sensitive edit-context fields, including raw title, content, password, meta, status, and guid, from non-public post objects such as wp_block synced patterns that WordPress core refuses to expose.

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code.

The Advanced Woo Labels plugin for WordPress is vulnerable to unauthorized data modification due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to and including 2.51. This allows authenticated attackers with Contributor-level access and above to create AWS labels rendered without proper escaping. The vulnerability was partially patched in version 2.46.

A weakness has been identified in ZongXR SuperMarket 1.0.0.0 affecting the startBuy function of the Instant Buy component. Manipulating the Username argument leads to missing authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be used for attacks. The project was informed but has not responded.

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0 affecting the OrderController.deleteOrder function of the Order Deletion Endpoint. Manipulating the orderId argument results in missing authentication. The attack can be carried out remotely. The exploit has been publicly released and may be used. The project was informed but has not responded.

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to disclose every co-booker's private id_token and PII, then use each leaked token to read, overwrite arbitrary appointment meta, or cancel the co-booker's appointment.

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application using the loader.

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the SnapshotPolicy.viewAny/SnapshotPolicy.view function of the /api/v1/snapshots file in the Snapshot Model component. This manipulation causes improper access controls. Remote exploitation is possible. The exploit has been publicly disclosed. Upgrading to version 1.7.2 addresses the issue.

The Newsletter plugin for WordPress up to version 9.3.9 has a vulnerability to insufficiently protected credentials. The public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant.

A vulnerability was found in David-Crty databasement up to 1.7.1, affecting the database-servers API endpoint in app/Http/Requests/Api/V1/RestoreRequest.php. Manipulation of the schema_name argument results in path traversal. The attack can be launched remotely but requires high complexity and is difficult to exploit; the exploit has been made public.

A vulnerability has been found in immich-app Immich up to 2.7.5, affecting the checkSharedLinkAccess function in server/src/utils/access.ts within the Shared Link Preview Handler. Manipulation of the Password argument leads to improper authorization. The reported GitHub issue was closed as a duplicate.

A flaw has been found in OpenSC up to 0.27.1, impacting the setcos_construct_fci_44 function in src/libopensc/card-setcos.c. Manipulation of the type_attr argument can lead to a stack-based buffer overflow. The attack can be launched remotely, and the patch is identified as ad730304052937c32b4eb489a06835ac6123632c.

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to impersonate whitelisted addresses or evade blacklists, gaining access to IP-restricted routes.

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restriction_min_los and restriction_max_los parameters, executing arbitrary JavaScript in the victim's administrative session.

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape room_num, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious payloads to execute arbitrary JavaScript in the victim's administrative session.

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing a JavaScript payload in the exceptions parameter that executes in an authenticated administrator's session when the victim follows the link.