CVE Vulnerability Catalog

Apache APISIX versions 2.12.0 through 3.17.0 are vulnerable to HTTP Request/Response Smuggling. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.

In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

In Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, which may result in Stored XSS, Privilege Escalation, or SSRF.

The ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63 contain an unauthenticated privilege escalation vulnerability. An attacker can gain higher privileges in the system.

The ACPT (Pro) - Custom Post Types Plugin for WordPress versions up to 2.0.63 contains a SQL Injection vulnerability exploitable by users with the Subscriber role.

The Kadence Shop Kit plugin for WordPress versions up to 3.0.6 contains a SQL Injection vulnerability exploitable by users with the Subscriber role.

The Visitor Traffic Real Time Statistics Pro plugin versions up to 11.17 contain an unauthenticated SQL Injection vulnerability. An attacker can manipulate database queries, potentially leading to unauthorized data access.

The Mobile App for WooCommerce plugin for WordPress versions up to 0.4.62 contains an unauthenticated Broken Access Control vulnerability.

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.

The Joomla Event Manager extension versions below 5.0.1 contain a privileged remote code execution vulnerability. The administrator can write dangerous file types including PHP, leading to remote code execution.

In the Joomla Event Manager extension before version 5.0.1, attendee lists are readable by any logged-in user. A non-manager can read attendee names, usernames, registration dates, and statuses for events they do not manage, including lists belonging to unpublished events.

In the Joomla Events Manager extension before version 5.0.1, there is a reflected XSS vulnerability via the PDF export link. The buildCurrentPdfLink function copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to a reflected XSS vector.

In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing cross-user event and venue takeover through forged form fields. A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.

In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing unauthenticated article overwrite and force-publish. Any visitor holding their own session token can republish and overwrite an article associated with an event.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it. Users with a role as low as subscriber can read arbitrary files on the server, including its configuration file and authentication secrets.