CVE Vulnerability Catalog

The Eventin plugin for WordPress up to version 4.1.23 is vulnerable to privilege escalation. The PermissionManager::manage_permissions() function is registered as a callback on WordPress core's map_meta_cap filter and unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping to plugin-specific capabilities. This allows authenticated attackers with user ID 1, even subscribers, to pass every WordPress capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, leading to full site takeover and remote code execution. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.

In SourceCodester Online Faculty Clearance System 1.0, a SQL injection vulnerability exists in an unknown function of the file /delete_faculty1.php, through manipulation of the ID argument. The attack can be executed remotely, and the exploit has been disclosed publicly.

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to SQL injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in SQL injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown function in the signup.php file of the Registration Flow component. Manipulation of the role argument leads to improper privilege management. The attack can be launched remotely, and the exploit has been publicly disclosed.

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. It affects an unknown function in the /web/order.php file. Manipulation of the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. It affects an unknown function in the /web/category-foods.php file. Manipulation of the ID argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. It affects the ZstdCompressCtx.loadDict function in ZstdCompressCtx.java of the Dictionary Sharing component. The manipulation leads to use after free. The attack can be executed remotely. Upgrading to version 1.5.7-14 resolves the issue.

Insufficient session expiration vulnerability in bizwell xClick allows authentication bypass. This issue affects xClick versions R2, R3, and R3.1.

Weights & Biases wandb before 0.29.0 fails to validate file names from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown functionality in the /College/login.php file. Manipulation of the User argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. It affects an unknown function in the /dets/forgot-password.php file. Manipulation of the email/contactno argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. It affects unknown code in the file /dets/index.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was detected in SabyasachiRana WebMap up to version 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. It affects the nmap_newscan function in functions_nmap.py of the New Nmap Scan Handler component. Manipulation of target/params arguments leads to OS command injection. The attack can be launched remotely, and the exploit is public. A patch is available (3d52f65803a2716bff14d938352c6fef45b0cfb6).

A vulnerability was detected in PHPGurukul Blood Donor Management System 1.0. It affects an unknown functionality in the file /application/controllers/admin/Report.php of the Report Endpoint component. Manipulation of fromdate/todate arguments results in SQL injection. The attack can be launched remotely, and the exploit is public.