CVE Vulnerability Catalog

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS. This issue affects Whistle - Sports Club: from n/a through 4.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS. This issue affects Voldor: from n/a through 1.0.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS. This issue affects Ogency: from n/a through 1.0.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS. This issue affects Treck: from n/a through 1.0.0.

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

The WPFunnels plugin for WordPress up to version 3.13.3 contains a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation.

The Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Th Shop Mania: from n/a through 1.9.1.

The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.

Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection. This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS. This issue affects WP Associate Post R2: from n/a through 5.0.1.

Reflected XSS vulnerability in the AcyMailing SMTP Newsletter WordPress plugin. Improper input neutralization during page generation allows an attacker to inject malicious script.

Deserialization of untrusted data vulnerability in the Quiz And Survey Master WordPress plugin, allowing object injection.

Envira Gallery Lite before version 1.16.2 has a missing authorization vulnerability in its gallery conversion REST endpoint, allowing lower-privileged authenticated users to create and publish galleries without required capabilities. Attackers can also supply arbitrary image IDs without ownership verification to publish unauthorized content.

Improper input validation vulnerability in Apache Camel Karavan. When a deployment is started, Karavan applies all resources from kubernetes.yaml without restricting resource kinds, security-sensitive pod options, or namespace.

Path traversal vulnerability in Apache Camel Karavan. A project file name supplied via the API is used verbatim as a path segment, allowing file writes outside the project directory to any writable location.