CVE Vulnerability Catalog

The shared-files-pro WordPress plugin before version 1.7.70 does not validate the file path supplied when creating a featured image. This allows unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

The User Frontend WordPress plugin before version 4.3.10 does not properly validate field type definitions and deserializes user-controlled post metadata when rendering submitted posts. Users with Editor-level access and above can inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The TranslatePress plugin for WordPress up to version 3.3.3 is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure.

The One User Avatar plugin for WordPress up to version 2.5.4 is vulnerable to Stored Cross-Site Scripting via the wpua_action_process_option_update function. Insufficient file type validation in wp_handle_upload() and reliance on attacker-controlled Content-Type header allow authenticated users with subscriber-level access to upload potentially executable files, which may lead to remote code execution. Exploitation requires admin to grant subscribers avatar upload permissions.

The LiteSpeed Cache plugin for WordPress up to version 7.8.1 is vulnerable to Stored Cross-Site Scripting via Comment Content. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. A payload crafted from decimal numeric character references bypasses WordPress's wp_kses sanitization.

The Forminator Forms plugin for WordPress up to version 1.57.0.1 is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the targeted Textarea field to have the Rich-Text editor option enabled.

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature, allowing an authenticated user with report administration permissions to gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature, allowing an authenticated user with report administration permissions to gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature, allowing an authenticated user with report administration permissions to gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

An out-of-bounds read vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.

An out-of-bounds read vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.