CVE Vulnerability Catalog

The Seed Fonts plugin versions up to 2.3.1 contains a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users with admin privileges.

The Beplus Sermon'e – Sermons Online plugin versions up to 1.0.0 has a stored Cross-Site Scripting (XSS) vulnerability for users with contributor privileges and above.

The WP Backup Manager plugin versions up to 1.13.1 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

The Google Map Shortcode plugin by Alain Gonzalez in versions up to 3.1.2 has an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

A vulnerability was found in SourceCodester Resort Management System 1.0 that leads to cross-site scripting (XSS) attacks through manipulation of the 'page' argument. The attack can be launched remotely.

The Dylan James Zephyr Project Manager plugin versions <= 3.3.93 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

The wpView plugin versions up to 1.3.0 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will execute in the context of users' browsers.

CVE-2023-2907 describes an improper neutralization of special elements used in SQL commands, allowing for SQL Injection attacks in the Marksoft application.

Podatność CVE-2022-46850 dotyczy wtyczki Easy Media Replace w wersjach do 0.1.3, która ma lukę w kontroli dostępu, umożliwiającą usunięcie dowolnych plików. Problem ten występuje w kontekście autoryzacji użytkowników.

A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file, which may occur due to a non-existent path or a path requiring permissions, such as /dev/null, while specifying zones.

Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Memory safety bugs exist in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs may lead to memory corruption, potentially allowing arbitrary code execution.

A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.

The vulnerability affects sites with invalid TLS certificates, where the activation-delay in Firefox was missing. A malicious page could exploit this flaw to trick users into clicking in precise locations, potentially bypassing the certificate error.

When recording the screen while in Private Browsing on Firefox for Android, the address bar and keyboard were not hidden, potentially leaking sensitive information. This bug only affects Firefox for Android and Focus for Android versions prior to 112.

In Firefox and Focus for Android, techniques were discovered to obscure the fullscreen notification, which could lead to user confusion and spoofing attacks. This affects Firefox for Android and Focus for Android versions prior to 112.

Potential use-after-free in libaudio, fixed by disabling AAudio backend on Android below version 30. Affects only Firefox for Android before 110.1.0.

In Apache Airflow, there is a vulnerability that may expose potentially sensitive values to users in certain situations. This issue affects versions from 2.5.0 before 2.6.2.

In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.