CVE Vulnerability Catalog

A vulnerability in the Booking Package plugin for WordPress up to version 1.7.16 allows privilege escalation via account takeover. Missing capability checks in the package_app_action AJAX endpoint let authenticated attackers with Editor-level access or above change the email and password of any account, including administrators.

The MDJM Event Management plugin for WordPress up to version 1.7.8.3 is vulnerable to Arbitrary File Upload via the mdjm_send_comm_email function due to lack of file type, extension, or MIME type validation. This allows authenticated attackers with administrator-level access to upload executable files, leading to remote code execution.

The Integration for Freshsales plugin for WordPress up to version 1.0.15 is vulnerable to stored XSS via form submission data due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an admin views CRM API error details.

The All-In-One Security (AIOS) plugin for WordPress up to version 5.4.7 is vulnerable to Stored XSS. An unauthenticated attacker can inject arbitrary HTML/JavaScript into the REST request path, which is stored in debug logs. When an admin views the debug log page, the script executes in their browser.

The WP User Manager – User Profile Builder & Membership plugin for WordPress up to version 2.9.17 has a Local File Inclusion vulnerability in the profile template scope function. Unauthenticated attackers can include and execute arbitrary .php files on the server, allowing access control bypass, sensitive data disclosure, or code execution.

Tapo C520WS v2 has a logic flaw in its API authorization mechanism. Restricted accounts can bypass whitelist restrictions and perform unauthorized operations like device reset or configuration changes.

The Admin Columns plugin for WordPress up to version 7.0.18 is vulnerable to PHP Object Injection leading to Remote Code Execution due to the use of unserialize() without an allowed_classes restriction in the IdsToCollection::get_ids_from_string() function. This allows authenticated attackers with Contributor-level access or higher to inject a serialized PHP object into a post's custom meta field and trigger arbitrary code execution via a bundled POP gadget chain.

A path traversal vulnerability in the Projects Service download endpoint of Altium Enterprise Server and Altium 365 allows an authenticated user to read arbitrary files (including entire directories as archives) from the server filesystem, potentially exposing configuration and credential data.

SSRF vulnerability in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request that the server treats as a URL and issues an outbound HTTP GET without validation, returning the response to the attacker.

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers. The local destination path is constructed by concatenating the configured download directory with a filename from remote cloud API metadata without basename normalization or path validation. An attacker controlling a filename returned by the API can use ../ sequences to write outside the configured directory, potentially overwriting arbitrary files including configuration or plugin files.

Stack overflow vulnerability in Tenda FH451 V1.0.0.9 in the fromDhcpListClient function allows an attacker to cause a DoS via a crafted HTTP request.

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 has a code injection vulnerability in the WaveDrom rendering pipeline. Attackers can embed malicious content in a wavedrom fenced code block, leading to arbitrary JavaScript execution in the VS Code webview context and arbitrary file writes on the local filesystem.

HAX CMS prior to version 26.0.1 uses `uniqid` for generating salts, which is unsuitable and can lead to predictable salts. Version 26.0.1 fixes this issue.

HAX CMS PHP versions 11.0.6 through 24.x.x have a file upload vulnerability that only validates file extensions via regex, without checking actual content or MIME type. Attackers can upload malicious files (e.g., PHP webshells) disguised as images, potentially leading to remote code execution.

In HAX CMS versions 25.0.0 to 25.0.0 (prior to 26.0.0), the haxcms_refresh_token cookie is set without the Secure flag. This allows transmission over unencrypted HTTP, making it vulnerable to theft via packet sniffing.

The AsyncHttpClient (AHC) library versions 2.x before 2.15.0 and 3.x before 3.0.10 leak Cookie headers to cross-origin redirect targets. During a redirect to a different origin, the Cookie header is not stripped, allowing session cookies to be sent to attacker-controlled servers. Fixed in versions 2.15.0 and 3.0.10.

A path traversal vulnerability in Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. This can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected.

Problem z niezaufaną ścieżką wyszukiwania w GlobalDatabasePlugin w AWS Advanced Go Wrapper dla Amazon Aurora PostgreSQL pozwala zdalnemu, uwierzytelnionemu użytkownikowi o niskich uprawnieniach na eskalację uprawnień do poziomu innego użytkownika Amazon RDS, w tym rds_superuser, poprzez stworzona funkcję, która uruchamia się, gdy ten użytkownik łączy się z klastrem przez dotknięty wrapper.

Problem z niezaufaną ścieżką wyszukiwania w GlobalDatabasePlugin w AWS Advanced JDBC Wrapper dla Amazon Aurora PostgreSQL pozwala zdalnemu, uwierzytelnionemu użytkownikowi o niskich uprawnieniach na eskalację uprawnień do poziomu innego użytkownika Amazon RDS, w tym rds_superuser, poprzez stworzona przez siebie funkcję, która uruchamia się, gdy ten użytkownik łączy się z klastrem przez podatny wrapper.

Wtyczka WP Captcha PRO dla WordPressa jest podatna na obejście uwierzytelniania we wszystkich wersjach do 5.38 włącznie. Problem wynika z tego, że obsługa AJAX ajax_run_tool() polega wyłącznie na weryfikacji nonce, bez sprawdzania uprawnień, co umożliwia generowanie linków do logowania bez hasła dla dowolnych użytkowników.