CVE Vulnerability Catalog

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript code in the user's browser through phishing attacks.

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.

A missing authentication for critical function vulnerability exists in baserCMS. If exploited, a remote attacker may obtain sensitive information.

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the bt_bb_section shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the bt_bb_image shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the bt_bb_icon shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Bold Page Builder plugin for WordPress up to version 5.7.2 is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the bt_bb_css_image_grid shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The WP Directory Kit plugin for WordPress up to version 1.5.4 is vulnerable to generic SQL Injection via the 'data_fields_list' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with custom-level access or higher to append additional SQL queries, potentially extracting sensitive information from the database.

The Smart Slider 3 plugin for WordPress up to version 3.5.1.38 is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress up to version 3.1.1 is vulnerable to Stored Cross-Site Scripting via the Data Table 'display_options' setting. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.