CVE Vulnerability Catalog

The WP Migration Plugin DB & Files – WP Synchro in versions up to and including 1.16.1 contains a subscriber bypass vulnerability. Technical details are not provided in the description.

The Fluent Affiliate Pro plugin in versions up to and including 1.6.4 is vulnerable to unauthenticated broken access control. Technical details are not provided in the description.

The Real 3D FlipBook plugin in versions up to and including 5.5 is vulnerable to unauthenticated Cross Site Scripting (XSS). Technical details are not provided in the description.

Missing authorization vulnerability in the Morning for WooCommerce (Green Invoice) plugin, versions up to 2.4.1. Allows exploiting incorrectly configured access control security levels.

The vulnerability allows contributor-level broken access control in WDS MCP Content Manager versions up to 3.10.4.

The IATO MCP plugin (iato-mcp) up to version 1.12.0 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Faktur Pro for WooCommerce (ZWEISCHNEIDER plugin) up to version 3.2.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can gain access to functions they should not have permissions for.

A security vulnerability in vllm-project vLLM up to 0.31.0 causes an out-of-bounds read in the function conv_ssm_forward in the file mamba_mixer2.py, within the Completions Request Handler component. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A flaw has been found in imgproxy up to 4.0.17 in the sanitizeElement function of processing/svg/svg.go in the SVG Handler component. Manipulation of input leads to cross site scripting, and the attack can be launched remotely. The exploit has been published and may be used; the project has not responded to the issue report.

The FluentBooking Pro plugin in versions below 2.5.0 is vulnerable to unauthenticated broken access control. Technical details are not provided in the description.

A vulnerability was detected in uptrace up to 2.1.0-beta.8 in the Login function of pkg/org/user_handler.go. Manipulation leads to information exposure through error messages. The attack can be initiated remotely and the exploit has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function. The attack can be performed remotely and the exploit has been made publicly available.

A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Drug Recommendation System 1.0 in Admin/add_drug.php. Input manipulation leads to client-side script execution. The attack can be performed remotely and the exploit has been publicly released.

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the Auth Guard component. Manipulation of the user_id argument leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3 in loginsystem/admin/change-password.php within the Change Password Handler component. Manipulation of the currentpassword argument causes incorrect authorization. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was discovered in jishenghua jshERP up to 3.5 in the updateAccountHeadAndDetail function of AccountHeadService.java within the Financial Receipt Update Handler component. Manipulation leads to improper authorization. The attack can be initiated remotely and the exploit has been publicly released.

A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file RoleController.java in the component User Detail Endpoint. Manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in chillzhuang SpringBlade up to 5.0.1 in ParamController.java within the Parameter Submit Management component. Manipulation of the initPassword argument results in improper authorization. The attack can be launched remotely and the exploit has been made public.

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5 in /jshERP-boot/accountHead/updateAccountHeadAndDetail within the Shopping Cart Quantity Handler component. Manipulation of the goodsCount argument results in business logic errors. The attack can be initiated remotely and the exploit has been made public.

A vulnerability was found in PickMall Lilishop up to 4.2.4 in /buyer/trade/receipt within the Buyer Invoice List component. Manipulation of the memberId argument leads to authorization bypass. The attack can be launched remotely and the exploit has been disclosed to the public.