CVE Vulnerability Catalog

The FileOrganizer WordPress plugin before version 1.2.0 does not validate file types in several file management operations, allowing authenticated users with file manager access (which its premium add-on can extend to sub-administrator roles) to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file type validation to the upload operation.

The Simple Membership WordPress plugin before version 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escapes a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.

The Ultimate Member WordPress plugin before version 2.12.0 fails to properly sanitize and escape custom textarea profile field values before outputting them on user profiles. This allows authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.

The AllCoach WordPress plugin before version 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password. This allows unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.

The Notifications for Forms & WordPress Actions plugin before version 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path. This allows authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.

A vulnerability has been found in SourceCodester Online Examination & Learning Management System 1.0 in the /ajax_enroll.php file of the Enrollment Management component. Manipulation of the student_id, schedule_id, or action arguments leads to improper authorization, allowing unauthorized access.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0/1.php in the file /edit_course1.php. An unknown function allows manipulation of the ID argument, leading to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam1.php. An unknown function improperly handles the ID argument, allowing remote attackers to execute arbitrary SQL queries. The exploit has been published and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_room.php file. An attacker can remotely manipulate the ID argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /pay.php file via the Bankname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in code-projects Real State Services 1.0 in the /builderHome.php file. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been made public, increasing the risk of attacks.

AIL Framework has a path traversal vulnerability in its PDF object handling. The PDF.get_filepath() function constructs a file path by joining the configured PDF storage directory with a PDF object identifier without verifying the resolved path stays within the intended PDF_FOLDER directory. An authenticated attacker can use crafted identifiers with relative traversal sequences or absolute path components to open files outside the PDF directory, potentially disclosing sensitive data.

A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/add_event.php file. An attacker can remotely manipulate the fdetails argument, leading to SQL injection.

A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/tour_reserves.php file. An attacker can remotely manipulate the tour argument, leading to SQL code injection. The exploit has been published and may be used.

A SQL Injection vulnerability was found in Hotel and Tourism Reservation 1.0 in the /admin/rooms.php file. An attacker can remotely manipulate the delete argument, leading to SQL injection. The exploit is publicly available.

A vulnerability in Pardus-Parental-Control allows DNS spoofing due to incorrect permission assignment for critical resources and improper access control. The issue affects versions up to and including 0.5.1, before 0.7.0.

Missing authorization in Pardus Update allows privilege escalation. The vulnerability affects versions 0.6.3 and earlier, fixed in version 0.6.6.

A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.

A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.

A vulnerability in Pardus Domain Joiner allows sensitive information exposure during process invocation. Affected versions are from 0.5.2 before 0.5.4, enabling data excavation.