CVE Vulnerability Catalog

The Academy LMS WordPress plugin before version 3.8.1 does not verify ownership of user identifiers in several AJAX handlers. Authenticated users with subscriber-level access can read and modify other users' lesson notes and mark their content as completed.

Vulnerability in the Classified Listing WordPress plugin (before version 5.3.9). Allows authenticated users with subscriber-level access to read payment receipt details of other users' orders, as the plugin does not verify that the order belongs to the requesting user.

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.

The Bit Form WordPress plugin before version 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email. This allows unauthenticated attackers to read arbitrary server files, such as the WordPress configuration file.

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.

The mongo-object package before version 3.0.3 is vulnerable to Prototype Pollution via the `expandKey()` function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing keys like `__proto__`.

SSRF vulnerability in Red Hat Quay's repository-level mirror configuration. A repository administrator can supply a crafted hostname causing the Quay mirror worker to make requests to internal network services.

In the ACL subsystem of kronosnet (versions <= 1.34), when configured for dynamic links without encryption, the validation trusts the link ID from packets. A remote unauthenticated attacker can spoof the link ID and bypass ACL, injecting arbitrary packets into the application layer.

In kronosnet (version <=1.34), the framework does not wipe sensitive memory after cryptographic configuration changes, leaving encryption keys in memory. A local attacker can retrieve them to decrypt cluster communications or inject malicious packets.

WPForms plugin for WordPress up to 2.0.0.1 has a Stored XSS vulnerability via the data-sitekey attribute of OptinMonster integration. Authenticated attackers with contributor-level access can inject scripts that execute on page view.

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

HCL DevOps Plan is potentially vulnerable to Cross-Site Scripting (XSS) that can be exploited if certain browser weaknesses are present.

A missing cryptographic step vulnerability (CWE-325) in FeliCa IC chips shipped before 2017. It may allow reading or tampering with data stored on the chip.

Vulnerability in trinodb trino 481 in the OAuth2/OIDC component allows remote open redirect via manipulation of the redirect_uri argument.

The SyncTeX parser (synctex_parser.c) in TeX Live and downstream applications like GNOME Evince contains a heap use-after-free vulnerability. Attackers can crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file.

SQL injection vulnerability in the /prescriptionorder.php file of itsourcecode Hospital Management System 1.0. The attack can be launched remotely and the exploit is publicly available.

Gitleaks prior to 8.30.1 contains a template injection vulnerability allowing attackers to read environment variables and exfiltrate sensitive data via Sprig template functions.

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

The scheduler-webhook plugin in Grav CMS contains an authentication bypass vulnerability. An unauthenticated attacker can remotely trigger configured scheduled jobs by sending a single POST request to the webhook endpoint.

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_html and _download_binary functions.