CVE Vulnerability Catalog

All versions of Apache Roller have insufficient input validation and sanitation in the category name, website about, and file upload features, allowing an authenticated user to perform an XSS attack.

A vulnerability was found in EmpowerID up to version 7.205.0.0 related to the Multi-Factor Authentication Code Handler, leading to information disclosure. The attack complexity is high and exploitation is known to be difficult.

A critical vulnerability was found in SourceCodester Hospital Management System version 1.0. Manipulation of the 'time' argument in the appointmentapproval.php file leads to SQL injection.

A vulnerability was found in mooSocial mooTravel version 3.1.8, classified as problematic. The manipulation leads to cross site scripting.

Insufficient session expiration in the GitHub repository admidio/admidio prior to version 4.2.11 may lead to unauthorized access.

A vulnerability has been found in mooSocial mooStore version 3.1.6, leading to cross site scripting attacks. An attacker can remotely manipulate an unknown functionality of the application.

A vulnerability was found in mooSocial mooStore version 3.1.6 that allows cross site scripting (XSS) attacks through manipulation of the argument q in the /search/index file.

A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0, allowing absolute path traversal via the FileDirectory argument in the file Service/FileHandler.ashx. The attack can be initiated remotely, and the exploit has been publicly disclosed.

The HTTP Headers plugin by Dimitar Ivanov in versions up to 1.18.11 has a stored Cross-Site Scripting (XSS) vulnerability with admin privileges.

The WooCommerce Shipping Multiple Addresses plugin versions <= 3.8.5 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The WPFactory Helper plugin versions <= 1.5.2 has an unauthenticated reflected XSS vulnerability.

The CartFlows Pro plugin versions <= 1.11.11 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The WP-buy WP Content Copy Protection & No Right Click plugin versions up to 3.5.5 contains a stored Cross-Site Scripting (XSS) vulnerability with admin-level permissions. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users visiting the site.

The My Content Management plugin versions up to 1.7.6 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

The David Lingren Media Library Assistant plugin versions up to 3.0.7 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 that allows an attacker to remotely manipulate the Files argument, leading to path traversal. The attack can be initiated remotely.

A Cross-site Scripting (XSS) vulnerability is reflected in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.

There is a SQL Injection vulnerability in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git.

A vulnerability was found in DedeBIZ 6.2.10, rated as problematic. It affects some unknown functionality of the Article Handler component and leads to cross site scripting attacks.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository instantsoft/icms2 prior to version 2.16.1-git, allowing attackers to inject malicious code into the application.