CVE Vulnerability Catalog

Cross Site Scripting (XSS) vulnerability in Pixel Manager for WooCommerce up to version 1.69.0. A user with Contributor role can inject malicious script.

Unauthenticated Insecure Direct Object References (IDOR) vulnerability in Simply Schedule Appointments up to version 1.6.12.31.

Safe SVG plugin version 2.5.0 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

Business Directory plugin version 6.4.27 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

Safe SVG plugin version 2.5.0 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Simply Schedule Appointments plugin version 1.6.12.29 and earlier contains a Broken Access Control vulnerability that can be exploited without authentication, allowing unauthorized access to functionality.

Apache WSS4J stores the Nonce of each accepted UsernameToken as raw base64 text, but authentication decodes that text and uses the bytes. The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-send it with a space added to the Nonce: the password digest still verified, but the token no longer matched the remembered one, so the replay was accepted. Since a UsernameToken does not cover the message body, the captured token could then be reused on requests of the attacker's choosing until it expired. Affects deployments with a nonce replay cache configured, as Apache CXF has by default, and only tokens using a password digest. The cache is now keyed on the decoded Nonce. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Maksisoft Gym versions from 0.5.10 before 0.5.11 contain an observable response discrepancy vulnerability that allows account footprinting, enabling attackers to determine if an account exists.

Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.

Flexible PDF Coupons plugin version 1.14.11 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Qi Addons For Elementor plugin version 1.11 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Cross Site Scripting (XSS) vulnerability in Premium Addons for Elementor versions up to 4.11.105. Allows an attacker to inject malicious script into the page.

SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The db_properties function in functions/DatabaseInc.php of the Save Data Handler component allows manipulation of the values argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The DBQuery function in functions/GetStuListFnc.php of the Student List Search Endpoint component allows manipulation of the LO_sort argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. An unknown function in functions/CustomFieldsFnc.php of the Student Search component allows manipulation of the cust argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic versions up to 1.21.0. Allows an attacker to perform unauthorized actions on behalf of a logged-in user.

Subscriber Cross Site Scripting (XSS) vulnerability in WP Photo Album Plus versions up to 9.3.02.003. Allows an attacker to inject malicious script into the page.

Cross Site Scripting (XSS) vulnerability in Supreme Modules Lite versions up to 2.5.63. An attacker with author privileges can inject malicious script.

Cross Site Scripting (XSS) vulnerability in CF7 Views – Complete Entry Management for Contact Form 7 versions up to 3.2.5. An attacker with contributor privileges can inject malicious script.