CVE Vulnerability Catalog

The Flexible Quantity – Measurement Price Calculator for WooCommerce plugin in versions up to and including 2.3.21 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.

The Booktics plugin in versions up to and including 1.0.24 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.

The Starter Templates plugin in versions up to and including 4.7.5 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they should not have permission to.

The RTMKit plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF). A user with the Subscriber role can be tricked into performing unwanted actions.

The Masteriyo - LMS plugin in versions up to and including 3.4.0 contains a Broken Access Control vulnerability. A user with the Subscriber role can perform actions beyond their granted permissions.

The Passster plugin in versions up to and including 4.3.13 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

The Slim SEO plugin in versions up to and including 4.10.0 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they do not have permission to.

The Simple Payment plugin in versions up to and including 2.5.4 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.

The Bold Page Builder plugin in versions up to and including 5.9.9 contains a Cross Site Scripting (XSS) vulnerability. A user with the Contributor role can inject malicious script code.

The 10up ElasticPress plugin in versions up to and including 5.3.4 contains an Insertion of Sensitive Information Into Sent Data vulnerability. This may allow retrieval of embedded sensitive data.

The Deposits and Partial Payments for WooCommerce plugin in versions up to and including 3.1.0 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files.

The Website Template by Arma Digital Media Inc. contains an Improper neutralization of special elements used in a template engine vulnerability. This may allow Code Injection. The issue affects versions through 11092026. The vendor was contacted but did not respond.

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 allows an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range.

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice, and for one of the calls the return value was ignored, which may lead to improper extraction of a member.

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint. The scripts are rendered in reporting views and execute in the browser sessions of teachers or administrators.

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.php). It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the source block. A user granted only an area-scoped add_block_to_area delegation on their own page can pass any block ID on the site, causing the source block's content to be duplicated into an area the rogue editor controls, disclosing that content, and the original block is then force-deleted in the same request.

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object (tree node) authorization is enforced when the group collection is returned. An authenticated user whose API token carries the groups:read scope can call GET /ccm/api/1.0/groups and receive every group on the site regardless of view permissions.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: before 8.4.2.0.

The Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including administrators, without holding an account on that site.