CVE Vulnerability Catalog

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands.

The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.

The Destekz plugin from Raera - Ankara Web Design and Digital Advertising Agency contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to 02062026, and the product is no longer supported by the vendor.

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to and including 2.2.1 due to insufficient input sanitization and output escaping.

The Zakra theme for WordPress up to version 4.2.0 is vulnerable to Stored Cross-Site Scripting. The REST API path bypasses sanitization for three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, zakra_menu_item_active_color), allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users view the page.

A vulnerability in Dell Client Platform BIOS allows authentication bypass due to a primary weakness. An unauthenticated attacker with physical access could potentially exploit this flaw, leading to information disclosure.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.16 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'data' attribute of the [adinserter] shortcode. The replace_ai_tags() function processes a {reusable-block-N} tag pattern calling get_post_field('post_content', N) without verifying user capabilities, restricting the post type to 'wp_block', or checking the post status.

The CURCY – Multi Currency for WooCommerce plugin for WordPress up to version 2.2.14 allows unauthenticated attackers to execute arbitrary shortcodes. This is due to insufficient validation of a value before passing it to the do_shortcode function.

The LatePoint plugin for WordPress up to version 5.6.1 is vulnerable to authorization bypass. Unauthenticated attackers can modify personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including administrator accounts, by submitting the booking form with a known email address. Exploitation requires guest bookings to be enabled.

The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.1.4 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can modify quizzes they do not own, overwrite result pages, and redirect notification emails to attacker-controlled addresses.

A vulnerability in Puppet resource_api causes sensitive parameters (e.g., passwords) to not be flagged as sensitive and are stored in cleartext in the agent's local transaction state cache. Affected versions include resource_api 1.5.0 through 1.9.1 and 2.0.0.

The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. Due to a logical error in the code, a request issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.

The JSON API User plugin for WordPress up to version 4.1.0 is vulnerable to Stored Cross-Site Scripting. An attacker with subscriber-level access or higher can inject malicious scripts via the 'content' parameter of the post_comment API endpoint and self-approve the comment, bypassing moderation.

The MotoPress Appointment Booking plugin for WordPress up to version 2.4.4 contains an authorization bypass vulnerability via user-controlled key. Unauthenticated attackers can overwrite customer data (name, email, phone, customer_id) in unconfirmed victim bookings by exploiting a publicly accessible REST endpoint.

The CM Business Directory plugin for WordPress up to version 1.5.7 is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when users visit affected pages.

The Ultimate Member plugin for WordPress is vulnerable to stored XSS via the 'about_me' parameter in versions up to 2.11.4 inclusive due to insufficient input sanitization and output escaping.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.29 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can read all debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 3.9.30 via the wpie_import_upload_file_from_url AJAX action. After wp_safe_remote_get() fails (blocking private IPs), the plugin falls back to GuzzleHttp\Client::request() with no SSRF protection and disabled TLS verification. This allows authenticated attackers with administrator-level access to make requests to arbitrary internal services, such as cloud metadata endpoints.

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open a specified URL.