CVE Vulnerability Catalog

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Authentication Bypass in versions up to and including 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper matches a WordPress user by user_login equal to the victim's email even if their user_email differs, and links that user's ID into the victim's LatePoint customer row. This allows authenticated attackers with Subscriber-level access to take over another customer's LatePoint account.

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard. This allows unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

The affiliate-toolkit WordPress plugin before version 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

The Ultimate Multisite WordPress plugin before version 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen. This allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

The Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. The attack can also target an already seeded client if the attacker knows the IDP URL used for enrollment.

A malicious actor with network access could exploit an Improper Access Control vulnerability in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation that could destroy and then replace a store path before content verification.

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

NetBird client versions 0.60.0 through 0.74.6 contain a command injection vulnerability allowing a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts due to improper escaping of peer names in SSH configuration.

The NewStatPress plugin for WordPress up to version 1.4.5 is vulnerable to Stored Cross-Site Scripting via the 'Last referrers' meta box on the Overview admin page due to insufficient output escaping, allowing unauthenticated attackers to inject arbitrary scripts.

The FV Flowplayer Video Player plugin for WordPress up to version 7.5.54.7212 is vulnerable to Stored Cross-Site Scripting via the 'synopsis' shortcode attribute due to insufficient input sanitization and output escaping, requiring the 'Parse Vimeo and YouTube links' option enabled and liststyle set to 'season'.

The Gmedia Photo Gallery plugin for WordPress up to version 1.25.1 is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Smart Forms plugin for WordPress up to version 2.6.104 is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to blind SQL Injection via the 'inputs' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Verified Reviews (Avis Vérifiés) plugin for WordPress up to version 2.4.6 is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Authentication bypass is possible due to loose comparisons in signature verification.

The Cryptocurrency Donation Box plugin for WordPress up to version 2.2.13 is vulnerable to Stored Cross-Site Scripting via the 'data_object' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce is publicly exposed to anonymous visitors.