CVE Vulnerability Catalog

The WordPress appointment-booking-calendar plugin version 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent XSS payloads through the admin.php page parameters.

The WordPress Plugin HB Audio Gallery Lite version 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.

WordPress Simple-Backup version 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php.

The WordPress Ultimate Product Catalog plugin version 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality.

The Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

The BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.

The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input.

The WordPress Booking Calendar Contact Form plugin version 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries.

The WordPress Booking Calendar Contact Form plugin version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter.

WordPress CP Polls version 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers, enabling arbitrary JavaScript execution in the browsers of users viewing the affected content.

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. This allows an authenticated attacker with any role or permission level to traverse out of the intended document directory and download arbitrary files accessible to the application.

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable.

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages, allowing access to restricted functions in other branches.

The Wertheim SafeController Family 65000, AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in a man-in-the-middle position can decrypt the data traffic.

The Wertheim SafeController 5400 (AssemblyVersion 6.11.8130.22320) uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path can sniff and replay RS-485 messages.

The application executing the JavaScript script embedded in the PDF within the sandbox fails to intercept some dangerous interfaces, allowing remote scripts to be loaded and resulting in arbitrary code execution.

Multiple printer drivers from Ricoh and Konica Minolta contain a privilege escalation vulnerability. An attacker with local access can elevate privileges using a specially crafted driver.

Quick.CMS deserializes user-controlled data received over plaintext HTTP without ensuring integrity or authenticity. Attackers can tamper with serialized payloads in transit and inject malicious objects, leading to remote code execution. Exploitation is triggered automatically when an administrator accesses the admin panel.

Vulnerability in Yealink SIP-T46U version 108.86.0.118 in the Web FastCGI Service component (mod_webd.BlueToothTest function in /api/inner/bttest). Manipulation of btMac/pin/reserved arguments leads to stack-based buffer overflow. Attack requires local network access.

Vulnerability in Yealink SIP-T46U version 108.86.0.118 in the Firmware Chunk Upload Handler component (sprintf function in /api/upgrade/upgrade). Manipulation of uid/start_offset arguments leads to stack-based buffer overflow. Attack requires local network access.