CVE Vulnerability Catalog

cjbassi/gotop is vulnerable to local argument injection via its process termination functionality. The process name is passed directly to pkill without sanitization, so a local attacker can create a process with a crafted name beginning with -- (e.g. containing a target user's UID). When the user running gotop invokes the kill feature on that process, pkill interprets the crafted name as a command-line option, terminating all processes owned by the targeted user. The product is no longer actively supported and the vulnerability has not been fixed; it was confirmed at version 3.0.0.

Server-Side Request Forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects versions before 2.1. Note: The vendor was contacted and it was learned that the product is not supported.

HAVELSAN Inc. Sef - AI Chatbot Platform before 2.1 has an improper certificate validation vulnerability allowing Adversary in the Middle (AiTM) attacks. The product is no longer supported.

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects versions before 2.1. Note: The vendor was contacted and it was learned that the product is not supported.

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The endpoint "/es/datatables/getemployeetypesdatatable" is affected.

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "nomListaValidacion" parameter is affected – endpoint "/es/validationslists/assignList/Employee/45659".

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation could allow an attacker to trick a user into executing arbitrary code in the victim's browser. The "name" parameter is affected – endpoint "/es/attachmenttypes/update/203336".

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to and including 5.122.0 due to insufficient input sanitization and output escaping. This requires the image attachment feature to be enabled, allowing unauthenticated attackers to submit a review with a malicious author name and upload an image via a public endpoint.

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 4.28.3 due to insufficient input sanitization and output escaping. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting.

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()` endpoint to serve that cached authenticated response to any subsequent unauthenticated GET request to the same URI.

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id they authored, as the can_access_page() gate requires only post authorship rather than the edit_others_posts capability for post owners.

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to and including 3.6.5.4 due to insufficient input sanitization and output escaping. The attack is possible via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint.

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to bypass sanitization.

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to and including 2.13.0 due to insufficient input sanitization and output escaping. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or user meta box.

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to and including 2.4.2 due to insufficient input sanitization and output escaping. This is exploitable on any board configured with the default write_level=0 and editor_type=N settings.

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lsd[remark]' parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly emitted on any page containing the [listdom-dashboard] shortcode.

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.22.0 due to insufficient input sanitization and output escaping. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to and including 5.1.7 due to insufficient input sanitization and output escaping. The CSRF gate protecting form submission is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie.

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to and including 9.4.0 due to insufficient input sanitization and output escaping. The subscription endpoint requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in the local part of the submitted address.

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.6.0 due to insufficient input sanitization and output escaping. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.