CVE Vulnerability Catalog

A vulnerability in SUSE neuvector manager before version 5.4.5 involves insertion of sensitive information into log files. This could expose confidential data in the manager container's logs.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves improper neutralization of special elements in an SQL command (SQL Injection). A low-privileged attacker with remote access could exploit this, leading to script injection.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves insertion of sensitive information into log files. A low-privileged attacker with local access could exploit this, leading to information exposure.

A vulnerability in Dell SCG 5.0 (Appliance and Application) before specific versions involves improper neutralization of special elements in an LDAP query (LDAP Injection). An unauthenticated attacker with remote access could exploit this, leading to script injection.

The WPMR Google Feed Manager for WooCommerce plugin for WordPress (up to and including version 2.23.7) is vulnerable to time-based SQL Injection via the 'feed' parameter due to insufficient escaping and lack of query preparation. Authenticated attackers with administrator-level access can append additional SQL queries to extract sensitive information from the database.

A flaw in the key provider component of the keycloak-services library (core engine for Red Hat Build of Keycloak) arises from an incomplete fix for path probing. A realm administrator can still submit arbitrary filesystem paths as keystore parameters, allowing determination of file existence and readability on the server, potentially exposing sensitive system information.

The myCred plugin for WordPress (up to and including version 3.2.4) is vulnerable to Stored Cross-Site Scripting via the 'wrapper' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files.

The Contact Form 7 Captcha WordPress plugin before version 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

The WP Express Checkout WordPress plugin before version 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying.

The Hustle WordPress plugin before version 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any shortcode registered on the site.

The CleanTalk WordPress plugin before version 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of the page.

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.5. Authenticated attackers with subscriber-level access can install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to and including 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers with Subscriber-level access to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor views the affected page.

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the plugin's stored configuration.

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.12.13. The plugin registers the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated users (wp_ajax_nopriv_) and the underlying add_offer_product_to_cart() function performs no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.