CVE Vulnerability Catalog

In the Ado::Sessions library for Perl up to version 0.935, insecure session IDs are generated. The IDs are based on the rand() function, epoch time, and PID, making them predictable. Ado is no longer maintained and has been removed from the CPAN index.

Amon2::Plugin::Web::CSRFDefender versions 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function attempts to read from /dev/urandom, but if unavailable, generates bytes using SHA-1 seeded with rand(), PID, and epoch time. PID comes from a small set, and time may be guessed. The rand() function is unsuitable for cryptographic purposes.

The Plus Addons for Elementor plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the Progress Bar shortcode due to insufficient input sanitization and output escaping. This affects versions up to and including 6.4.9.

Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If exploited, an arbitrary script may be executed in the web browser of the user who accessed the website using the product.

The LatePoint plugin for WordPress up to version 5.3.0 contains a Stored XSS vulnerability via the 'button_caption' parameter in the [latepoint_resources] shortcode. Attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.

The Prime Slider plugin for Elementor up to version 4.1.10 contains a Stored XSS vulnerability via the 'follow_us_text' setting in the Mount widget. Insufficient input sanitization and output escaping allow attackers with author-level access or higher to inject arbitrary scripts.

The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.

Missing authorization in the MainWP Child Reports plugin for WordPress (up to version 2.2.6). Authenticated attackers with Subscriber access can obtain activity log entries (including action summaries, user info, IP addresses) via the Heartbeat API.

The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress up to version 3.3.13 lacks authorization in its webhook handler. Unauthenticated attackers can modify subscription settings, downgrading paid plans to Trial and changing store type and expiration dates.

The Investi plugin for WordPress up to version 1.0.26 has a stored XSS vulnerability via the 'maximum-num-years' attribute of the 'investi-announcements-accordion' shortcode. The attribute is not properly sanitized, allowing authenticated attackers with contributor-level access to inject arbitrary scripts.

The TableOn WordPress plugin up to version 1.0.4.4 contains a stored XSS vulnerability via shortcode attributes 'class', 'help_link', 'popup_title', and 'help_title'. These attributes are not properly sanitized or escaped before being inserted into HTML, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts.

The Strong Testimonials plugin for WordPress versions up to 3.2.21 contains a stored cross-site scripting vulnerability via the testimonial_view shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The LightPress Lightbox plugin for WordPress up to version 2.3.4 contains a stored XSS vulnerability via the `group` attribute in the `[gallery]` shortcode. Lack of proper escaping allows authenticated attackers with Contributor-level access and above to inject arbitrary scripts that execute when a page is viewed.

The Blubrry PowerPress plugin for WordPress versions up to 11.15.15 contains a stored cross-site scripting vulnerability via the 'powerpress' and 'podcast' shortcodes due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The latest version of parisneo/lollms contains an insufficient session expiration vulnerability. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to the absence of logic to reject requests after inactivity and the excessively long default session duration of 31 days. Attackers can maintain persistent access to a compromised account even after the victim resets their password.

In Go, context was not properly tracked across template branches for JS template literals, leading to incorrect escaping. Template actions within JS template literals also did not track brace depth, causing improper escaping. These issues could lead to XSS vulnerabilities.

The tar.Reader function in Go can allocate an unbounded amount of memory when reading a maliciously crafted archive containing a large number of sparse regions encoded in the 'old GNU sparse map' format.

On Linux, if the target of Root.Chmod is replaced with a symlink during the chmod operation, Chmod can operate on the symlink target even if it lies outside the root. The fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag. Root.Chmod checks its target before acting and returns an error if the target is a symlink outside the root, so impact is limited to cases where the target is replaced between check and operation.

The Elementor Website Builder plugin for WordPress up to version 3.35.5 contains a Stored XSS vulnerability via several widget parameters. Insufficient input sanitization and output escaping allow attackers with contributor-level access or higher to inject arbitrary scripts.

The Gravity Forms plugin for WordPress up to version 2.9.30 is vulnerable to Reflected XSS via the `form_ids` parameter in the `gform_get_config` AJAX action. This is due to the `GFCommon::send_json()` method outputting JSON data wrapped in HTML comments with a `Content-Type: text/html` header instead of `application/json`. The `wp_json_encode()` function does not HTML-encode angle brackets, allowing injected HTML/script tags. The `config_nonce` is publicly embedded on every page with a Gravity Forms form, making it identical for all unauthenticated visitors within a 12-hour nonce tick. This allows unauthenticated attackers to inject arbitrary web scripts if they can trick a user into clicking a link. The vulnerability does not work against authenticated users.