CVE Vulnerability Catalog

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path. This allows the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

A vulnerability was found in Frappe HR up to 16.15.0, affecting the get_expense_claims/get_shift_requests/get_attendance_requests functions in hrms/api/__init__.py (Permission Validation component). Manipulation of the employee argument leads to incorrect authorization. The attack can be launched remotely; the vendor confirmed the issue has already been fixed.

Joomla Extension regularlabs.com Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 is vulnerable to privileged stored XSS via data-rlta-url attributes. The plugin accepts a url option for an item and writes it to a generated data-rlta-url attribute, which the browser code passes to window.open() when the item is activated. Affected versions do not reject browser URL schemes that execute JavaScript.

A security vulnerability was detected in notionnext-org NotionNext up to 4.10.10, affecting the cleanCache function in pages/api/cache.js (Authentication Guard component). Manipulation of the token argument leads to missing authentication. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check; in versions 4.9.5.7 - 4.10.10 a guard exists but is only enforced when CACHE_REVALIDATION_TOKEN is set, so default deployments remain unprotected. The vendor did not respond to the disclosure.

A weakness was identified in Cesanta Mongoose up to 7.21, affecting the fn function in tutorials/mqtt/mqtt-server/main.c (MQTT Broker component). Manipulation leads to a stack-based buffer overflow. The attack can be launched remotely and the exploit is publicly available. Upgrading to version 7.22 (patch a9df523f76f43a38bd53b4232b9cfd4c16869e71) addresses the issue.

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24.

In Eyeplus 57.0.0.0308, an unknown function in the file /snapshot of the p2pcam Service leads to information disclosure. The attack can be performed remotely. The exploit has been published and may be used.

In Eyeplus 57.0.0.0308, the GetUsers function in the /onvif/Device file of the ONVIF component leads to information disclosure. The attack can be executed remotely. The exploit is now public and may be used.

In GEOritm up to version 2.45.1, manipulation of the objectId argument in the /restapi/objects/obj-groups file of the REST API component leads to missing authentication. The attack can be launched remotely. The exploit is publicly available. Upgrading to version 2.46 mitigates the issue.

A vulnerability in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007 affects an unknown functionality of the file /wallpaper in the Wallpaper Upload component. Manipulation of the wallpaper argument causes improper validation of syntactic correctness of input. The attack can be initiated remotely, and the exploit has been publicly disclosed.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the updateJiraProjects function in the /jira-import file of the Jira Import component leads to server-side request forgery via manipulation of host/username/token arguments. The attack can be initiated remotely. The exploit has been disclosed to the public.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack may be performed remotely. The exploit has been published.

In DevaslanPHP project-management versions 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1, the whereRaw function in the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the Timesheet Dashboard component is vulnerable to SQL injection via manipulation of the filter argument. The attack can be carried out remotely. The exploit is now public.

In fuzui StudentInfo up to commit fcc42a639ec7cef620651bfd0f07ebb660529e3f, an unknown function in the file /StudentInfo/StudentHandler/moditypasswordstu of the Password Change Endpoint component is vulnerable to authorization bypass via manipulation of sid/tid arguments. The attack can be executed remotely. This product uses a rolling release, so version information is unavailable.

In Trusted Domain Project OpenARC up to version 1.0.0.Beta1, the arc_parse_canon_t function in the library libopenarc/arc-canon.c of the libopenarc component leads to a null pointer dereference. The attack may be launched remotely. The exploit has been released to the public. Upgrading to version 1.0.0.Beta0 is recommended.

A vulnerability was identified in CloudClassroom-PHP-Project allowing SQL injection in updateguest.php via the gname argument. The attack can be initiated remotely and the exploit is publicly available.