CVE Vulnerability Catalog

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine. The filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow. When both features are enabled, unauthenticated users can register and log in without being approved by an administrator.

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails. When a recipient field is configured to echo a submitted value, unauthenticated attackers can replace the recipient list and relay attacker-composed email from the site's own domain.

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications. Verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.

The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount. This allows an unauthenticated attacker holding a single genuine low-value transaction to mark arbitrary higher-value orders as paid.

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. A client configured to only allow the `code` response type could receive back a valid token of another type, such as `id_token`. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.

Some API endpoints allowed creating order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.

Dell PowerProtect Data Domain contains an Allocation of Resources Without Limits or Throttling vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to denial of service.

Dell PowerProtect Data Domain contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to denial of service.

Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of Service.

Dell PowerProtect Data Domain contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell PowerProtect Data Domain contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for the attacker.

Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Dell PowerProtect Data Domain contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

HAVELSAN Inc. Liman MYS contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. This issue affects Liman MYS before version 2.3.5-1132.

Dell PowerProtect Data Domain contains an Improper Validation of Integrity Check Value vulnerability. A high privileged attacker with local access could exploit it to bypass protection mechanisms.

DefterAsist Financial Advisor Platform contains a cross-site scripting vulnerability due to improper neutralization of input during web page generation, allowing Stored XSS.

The Enable Media Replace plugin for WordPress in all versions up to and including 4.2.2 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing authenticated attackers with author-level access and above to modify the post_content of any published post referencing the replaced media, including Administrator-owned posts. The doReplaceQuery() method performs a database-wide search-and-replace without per-post capability checks.

An out-of-bounds write vulnerability in Samsung Open Source escargot allows buffer manipulation. This may lead to memory corruption or unexpected code execution.

The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress in versions up to and including 17.214.0 is vulnerable to Reflected Cross-Site Scripting via the 'new_kb_config' parameter, specifically the article-mobile-break-point-v2 key. This is due to insufficient input sanitization and output escaping in EPKB_Frontend_Editor::fe_preview_config() and EPKB_Articles_Setup, where attacker-controlled data is concatenated into a <style> element without escaping. This allows unauthenticated attackers to inject arbitrary scripts that execute if they trick a user with Editor-level access or above into clicking a crafted link.