CVE Vulnerability Catalog

The Gallery by BestWebSoft plugin for WordPress up to version 4.7.9 is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys. The gllr_save_postdata() function stores unsanitized array keys from $_POST directly into post meta, which are later used in SQL queries without prepared statements.

The WP Travel Engine plugin for WordPress up to version 6.8.4 is vulnerable to authorization bypass, allowing unauthenticated attackers to view private booking billing details, including the customer's first name, last name, email, street address, city, and phone number, by binding an arbitrary booking ID to the attacker's session.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.

The Infility Global plugin for WordPress up to version 2.15.21 is vulnerable to Stored Cross-Site Scripting via the /cf7_record endpoint. Unauthenticated attackers can inject arbitrary scripts that execute for any logged-in user visiting the records page.

The Extra Product Options Builder for WooCommerce plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The plugin writes a deny-all rule into its upload directories, so disclosure only occurs on servers that honor it, such as Apache; on default nginx setups, files are already served directly.

The CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 lacks authorization checks in some REST API endpoints, allowing unauthenticated users to retrieve the title, type, size, and URL of media attachments assigned to any folders, including unpublished ones.

The WP Directory Kit WordPress plugin before version 1.5.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection. On multisite, a single-site admin can read data from the entire network.

The WCPOS – Point of Sale (POS) plugin for WooCommerce up to version 1.9.14 is vulnerable to Code Injection via the 'thermal' template engine. Authenticated attackers with Shop Manager-level access can inject arbitrary PHP code into a template that is subsequently executed on the server, leading to remote code execution.

The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.

The Royal Elementor Addons plugin for WordPress up to version 1.7.1064 contains a Server-Side Request Forgery (SSRF) vulnerability in the Form Builder widget. An attacker with Contributor-level access can make requests to arbitrary locations, including internal services.

The Podlove Podcast Publisher plugin for WordPress up to version 4.5.3 contains an arbitrary file deletion vulnerability. Authenticated attackers with Contributor-level access can delete arbitrary files on the server, potentially leading to remote code execution.

The Platnosci Online Blue Media (Autopay) plugin for WordPress up to version 5.0.0 contains a Stored Cross-Site Scripting (XSS) vulnerability. Unauthenticated attackers can inject arbitrary scripts that will execute on the WooCommerce checkout page.

The Query Wrangler plugin for WordPress up to version 1.5.57 contains a remote code execution vulnerability. Missing capability check and nonce verification in the AJAX handler allow authenticated attackers with Subscriber-level access to execute code on the server.

A SQL injection vulnerability has been found in Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. It affects an unknown function in the file /osrf-gateway-v1 of the open-ils.fielder OpenSRF Service component. The attack can be executed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in the Online Shopping System 1.0 by code-projects. It affects an unknown function in the file /login.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit has been made public.

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image, compressed chunks are decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker can submit a crafted DAA file with highly compressed data, causing excessive memory and CPU consumption, potentially making the extraction worker unresponsive or terminating it, affecting service availability.

SiYuan before v3.7.4 contains an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

A weakness has been identified in Jinher OA 1.0. An unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx is affected. Manipulation of the argument httpOID causes SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used for attacks. The vendor was contacted but did not respond.

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. An unknown function of the file /etc/config/easycwmp is affected. The manipulation results in hard-coded credentials. Remote attack is possible but highly complex and difficult to exploit. The exploit has been released publicly and may be used. The vendor was contacted but did not respond.