CVE Vulnerability Catalog

Missing authorization in Event Tickets (up to 5.30.0.1) allows exploiting incorrectly configured access control security levels.

Stored XSS vulnerability in Robo Gallery (up to 5.1.6) due to improper input neutralization.

Missing authorization in Ultimate Post Kit (up to 4.5.5) allows exploiting incorrectly configured access control security levels.

Missing authorization in YITH WooCommerce Product Bundles (up to 2.29.0) allows exploiting incorrectly configured access control security levels.

Stored XSS vulnerability in MasterStudy LMS (up to 3.7.52) due to improper input neutralization.

Stored XSS vulnerability in WP Store Locator (up to 3.0.3) due to improper input neutralization.

The Vitepos plugin (by Appsbd) up to version 3.6.1 contains a Blind SQL Injection vulnerability that allows an attacker to manipulate database queries.

Missing authorization in VillaTheme Core (up to 1.0.5) allows exploiting incorrectly configured access control security levels.

Stored XSS vulnerability in ShortPixel Image Optimizer (up to 6.5.6) due to improper input neutralization.

The Joomla extension Gridbox (by balbooa.com) below version 2.20.4.0 contains a CSRF vulnerability in the language installation feature because the addLanguage action does not require POST and does not validate the session token.

Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.

AKINSOFT WOLVOX Control Panel by AKIN Software contains a sensitive information insertion vulnerability into sent data, allowing Pull Data from System Resources. The issue affects versions from 26.02.25 before 26.02.26.

OctoCloud (by AKIN Software) versions from 1.12.06 before 1.12.07 contain an authorization bypass through User-Controlled key vulnerability, allowing access to functionality not properly constrained by ACLs.

Improper certificate validation in the webmail of hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. The webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address.

hMailServer (by Progressive Robot) versions 6.0.0 through 6.3.5 fail open when applying DANE (RFC 7672) to outbound SMTP delivery, allowing an attacker to disable DANE for a DNSSEC-signed recipient domain and intercept or modify messages.

Inefficient algorithmic complexity in the webmail's message view of the REST API in hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once.

Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number.

hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position.

Inefficient algorithmic complexity in the decoding of message header fields in hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks.

hMailServer (by Progressive Robot) versions 6.3.4 and 6.3.5 have inefficient algorithmic complexity in bounce and complaint processing, allowing a remote unauthenticated attacker to stop mail delivery.