CVE Vulnerability Catalog

The WooCommerce Bulk Stock Management plugin versions <= 2.2.33 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious JavaScript code.

The WooCommerce PayPal Payments plugin versions <= 2.0.4 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The MasterStudy LMS plugin for WordPress versions <= 3.0.8 has a broken access control vulnerability that allows logged-in users, such as subscribers, to view the plugin's orders and obtain order-related data like email, username, and more.

A remote code execution (RCE) vulnerability was discovered in Onlyoffice Community Server before version 12.5.2 via the UploadProgress.ashx component.

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). The application dynamically builds web page parts using user inputs without proper verification or filtering, allowing injection of malicious HTML/JavaScript code. This code is saved and executed in the victim's browser.

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. An attacker can inject malicious formulas into CSV files exported from the system, potentially leading to code execution on the victim's side.

The MasterStudy LMS plugin for WordPress versions <= 3.0.7 has a stored Cross-Site Scripting (XSS) vulnerability for contributor+ users.

Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable} at /act/ActDao.xml.

A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus versions 15.1.0 to 16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.

IBM SPSS Modeler on Windows versions 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key, which could allow a local user to decrypt and obtain sensitive information.

Wtyczki Abandoned Cart Lite dla WooCommerce oraz Abandoned Cart Pro dla WooCommerce w WordPress są podatne na przechowywane ataki Cross-Site Scripting (XSS) poprzez wiele parametrów w wersjach do 5.1.3 i 7.12.0. Problem wynika z niewystarczającej sanitizacji danych wejściowych oraz ucieczki danych wyjściowych.

Blogengine.net version 3.3.8.0 and earlier is vulnerable to Open Redirect, which may allow attackers to redirect users to malicious sites.

A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution.

A cross-site scripting (XSS) vulnerability was discovered in User Registration & Login and User Management System v1.0 via the component /admin/search-result.php.

The urlnorm crate through version 0.1.4 for Rust is vulnerable to a Denial of Service (DoS) attack via a crafted URL. The supplier disputes this vulnerability, claiming that 'slow printing of URLs is not a CVE.'

Podatność związana z niewłaściwą walidacją danych wejściowych w demonie protokołu routingu (rpd) systemu Junos OS firmy Juniper Networks pozwala nieautoryzowanemu atakującemu zdalnemu na spowodowanie odmowy usługi (DoS). Problem występuje, gdy wiadomość aktualizacji BGP zawiera określony, opcjonalny atrybut transytywny, co prowadzi do zerwania sesji BGP.

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was found to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This issue is fixed in version 6.2.6.1-GA.

An access control issue in Makves DCAP v3.0.0.122 allows unauthenticated attackers to obtain cleartext credentials via a crafted web request to the product API.

The Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, allowing an attacker to manipulate SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process.

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary administrative commands.