CVE Vulnerability Catalog

The Simply Schedule Appointments WordPress plugin before version 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see. This allows users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

The ECS WordPress plugin before version 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor). A Contributor can write a data-source binding into any post, including admin-authored pages, whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.

The ECS WordPress plugin before version 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions. This allows unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

The Groundhogg plugin for WordPress up to version 4.5.14 is vulnerable to SQL injection via the tag_query parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information. Exploitation requires triggering the Legacy_Contact_Query code path via an unknown filter type.

The Beaver Builder Page Builder plugin for WordPress up to version 2.10.2.2 is vulnerable to stored cross-site scripting via the Button Code setting in the Button Module. Insufficient input sanitization and output escaping allow authenticated attackers with author-level access to inject arbitrary scripts that execute when a user accesses an injected page.

The Contest Gallery plugin for WordPress up to version 30.0.7 is vulnerable to second-order SQL injection via the cg_multiple_files_for_post and cgRealId parameters. Insufficient escaping and lack of query preparation allow authenticated attackers with author-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via JSON keys/values patterns. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via the 'key' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Form Maker by 10Web plugin for WordPress up to version 1.15.44 is vulnerable to blind SQL injection via the '{username}' placeholder in a dynamic-choice field. Authenticated attackers with subscriber-level access can append additional SQL queries to extract sensitive information from the database.

The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.

The KiviCare plugin for WordPress up to version 4.5.1 is vulnerable to generic SQL injection via the 'searchTerm' parameter. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.

The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.

The Image Uploader for Welcart plugin for WordPress up to version 1.4.6 is vulnerable to generic SQL injection via the 'post_title' parameter. Authenticated attackers with author-level access can append additional SQL queries to extract sensitive information from the database.

The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.8 is vulnerable to price manipulation via the 'cart_data' parameter. Unauthenticated attackers can override the WooCommerce checkout price of any bookable product to an arbitrary value, enabling purchase at a self-chosen price.

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.

In Red Hat Quay, a user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit an SSRF vulnerability within the build API by providing a malicious URL, causing the builder to make requests to internal network addresses.

In Red Hat Quay's exported logs feature, an unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. File IDs can be intercepted from plaintext email or webhook callbacks.

In Red Hat Quay's Stripe billing webhook handler, an unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header.

In Red Hat Quay, when SECURITY_SCANNER_V4_PSK is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint, allowing flooding of the notification queue and injection of path traversal characters into Clair API URL paths.

In Red Hat Quay, an administrator of any repository, by knowing or guessing a target notification's UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. They can also trigger test notifications for another repository.