CVE Vulnerability Catalog

The PICA Photo Gallery plugin 1.0 for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.

The KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an unescaped GET parameter. Attackers can inject SQL code through the 'kc_ad' parameter in base.css.php or kittycatfish.php to extract sensitive database information using boolean-based blind or time-based blind techniques.

The Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploiting the unescaped 'idsignup' POST parameter. Attackers can send crafted requests to the admin-ajax.php endpoint with malicious SQL payloads in the 'idsignup' parameter to read arbitrary data from the database.

The Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.

The WordPress Car Park Booking plugin from October 13, 2017 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.

The Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to extract sensitive database information including user credentials and site configuration data.

The Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the 'pollid' POST parameter. Attackers can send requests to the admin-ajax.php endpoint with the 'spAjaxResults' action and malicious 'pollid' values to execute arbitrary SQL queries and read sensitive data from the WordPress database.

Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) via the Media Module, potentially exposing sensitive files like logs. Affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

Backend users with write access to the form_definition table can directly create, update, or delete form definitions via DataHandler, bypassing Form Framework validation and permission checks. This allows arbitrary form configurations, SQL injection, and privilege escalation.

Backend users with file write permissions can upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass Form Framework restrictions. Malicious files can execute arbitrary SQL statements, allowing privilege escalation by creating admin accounts.

Non-privileged backend users with file mount access can perform write operations on folders representing the root of an active file mount due to missing authorization restrictions.

Backend users with access to the Form Framework can use files not ending in .form.yaml as form definitions, which are processed without denying the incorrect extension. Malicious form definition files can execute arbitrary SQL statements, enabling privilege escalation and admin account creation.

SINEC INS (all versions prior to V1.0 SP2 Update 6) uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and an insufficient number of iterations. This allows an attacker to efficiently recover user passwords using brute-force or precomputed attacks (e.g., rainbow tables).

In SINEC INS prior to V1.0 SP2 Update 6, a binary is configured with the cap_dac_override capability, bypassing file system permission checks. A local attacker can escalate privileges, modify arbitrary files, and gain root access.

In SINEC INS versions prior to V1.0 SP2 Update 6, user input is not properly sanitized in the /api/sftp/uploadFiles endpoint, allowing injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved.

A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code. This enables theft of administrative access tokens and session credentials.

A vulnerability in SIMATIC WinCC Unified PC Runtime (versions V16 through V21 before V21 Update 2) is due to insufficient protection of key material in the WinCC Certificate Manager, which could allow an attacker to extract sensitive information.

The Blocksy theme for WordPress up to version 2.1.35 is vulnerable to PHP Object Injection leading to Remote Code Execution. Insufficient input sanitization and unconditional deserialization during V200 migration allow authenticated attackers with contributor-level access to inject a serialized object that executes arbitrary PHP code upon deserialization.

The Events Calendar for GeoDirectory plugin for WordPress up to version 2.3.28 has a privilege escalation vulnerability. The ajax_ayi_action() handler does not properly sanitize the 'type' and 'postid' parameters, allowing an authenticated attacker with Subscriber-level access to escalate to Administrator by passing type=wp_capabilities and postid=administrator.