CVE Vulnerability Catalog

Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.

Stored XSS vulnerability in the Quiz And Survey Master plugin by ExpressTech. Improper input neutralization during page generation allows persistent execution of malicious scripts.

The Booktics plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.0.27.

The Hustle plugin (versions up to and including 7.8.14.2) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Hustle from n/a through 7.8.14.2.

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 allows attackers to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated, resulting in the webserver accepting any valid JWT.

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79).

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.

Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The attack requires 'trusted_jar_paths' to have a non-empty value configured by the Impala admin.

The OMGF WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 's' Search Parameter in comments-atom Feed in all versions up to and including 6.3.10 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, provided the front-end server serves the retained .tmp file without proper Content-Type headers.

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200 web portal allows an authenticated user to read any file or list any directory accessible to the web server user by modifying the URL with a path traversal payload.

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.

A vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.

In the IEEE 802.15.4 stack in Zephyr, the function ieee802154_decipher_data_frame() does not check if the frame is long enough before computing the payload length. Subtracting the header and authentication tag length from the frame length can underflow, leading to an out-of-bounds read and write. An attacker within radio range can send a short frame, causing memory corruption and system crash.

A vulnerability in the Zephyr Bluetooth Mesh stack affects the Solicitation PDU handler in sol_pdu_decrypt(). Received PDU is copied into a fixed 17-byte stack buffer without length checking, leading to stack overflow in production builds where assertions are disabled. An attacker can send a crafted advertisement to trigger out-of-bounds write without any cryptographic keys.

This vulnerability in the ERP system is due to unsafe deserialization of user-controlled data in the affected functionality. An unauthenticated remote attacker could exploit this by supplying specially crafted data to the vulnerable functionality.

This vulnerability in the ERP system is due to insufficient validation and parameterization of user-supplied input in an API endpoint. An unauthenticated remote attacker could exploit this by supplying specially crafted input to the vulnerable endpoint.

This vulnerability in the ERP system is due to improper validation of payment callback parameters and inadequate authentication controls in an API endpoint. An unauthenticated remote attacker could exploit this by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification.

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache to write past it and into the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed.

Joomla Extension - OrdaSoft Simple Membership before 7.4.0 has an unauthenticated SQL injection vulnerability. The site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control. The handler reads a login parameter through Joomla's generic non-sanitizing input filter, which strips HTML/script tags but not quotes or SQL syntax, and concatenates it directly into a query without escaping or parameterization.

The Joomla extension OrdaSoft Touch Slider (before 5.4.6) has an unauthenticated destructive CRUD vulnerability. The function modOsTouchSliderHelper::getAjax() is the single handler for data operations, with no user check, authorization, or CSRF token. An unauthenticated attacker can delete slider images and replace entire database tables.