CVE Vulnerability Catalog

Unauthenticated Local File Inclusion (LFI) in Fabius versions up to 1.0. Allows an attacker to read files from the server without authentication.

Unauthenticated Local File Inclusion (LFI) in Teoro versions up to 1.1. Allows an attacker to read files from the server without authentication.

Unauthenticated Local File Inclusion in the Kaven plugin up to version 1.2. An attacker can exploit this to read arbitrary files on the server.

Unauthenticated Local File Inclusion in the Volos plugin up to version 1.2. Allows an attacker to read files from the server without authentication.

Unauthenticated Local File Inclusion in the Cardea plugin up to version 2.3. An attacker can read arbitrary files on the server without logging in.

Unauthenticated Cross Site Scripting (XSS) in the Ambed plugin up to version 1.0.0. An attacker can inject malicious script into the page that executes in the user's browser.

PHP Object Injection vulnerability in Yacht Rental versions up to and including 2.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Wine House versions up to and including 3.20. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Tipsy versions up to and including 1.6. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Stargaze versions up to and including 1.10. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

PHP Object Injection vulnerability in Splendour versions up to and including 1.23. An unauthenticated attacker can inject a malicious PHP object. This may lead to further exploitation of the system.

Unauthenticated Sensitive Data Exposure in the Contact Form 7 – Dynamic Text Extension up to version 5.0.7. An attacker can access sensitive information without logging in.

Unauthenticated Broken Authentication in the eRoom plugin up to version 1.7.1. An attacker can bypass authentication mechanisms and gain unauthorized access.

Unauthenticated Cross Site Scripting (XSS) in the Document Embedder plugin up to version 2.4.0. An attacker can inject malicious script that executes in the user's browser.

The AWS S3 for WordPress Plugin – Upcasted in versions up to 3.1.0 has a subscriber broken access control vulnerability. A subscriber-level user can perform actions they should not be authorized for.

Unauthenticated Cross Site Scripting (XSS) in the Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21. An attacker can inject malicious script into the page.

Subscriber Settings Change in the uListing plugin up to version 2.2.0. A user can change subscription settings without proper permissions.

Local File Inclusion vulnerability in DirectoryPress versions up to and including 3.6.27. An unauthenticated attacker can include local files, potentially leading to information disclosure or code execution. The issue affects unauthenticated access.

SQL Injection vulnerability in uListing versions up to and including 2.2.0. An unauthenticated attacker can inject malicious SQL queries, potentially leading to disclosure or modification of database data. The issue affects unauthenticated access.

Unauthenticated Server Side Request Forgery (SSRF) in the StreamCast plugin up to version 2.4.5. An attacker can send requests from the server to internal resources.