CVE Vulnerability Catalog

The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to and including 1.15.43. This issue arises from insufficient escaping of the user-supplied parameter and lack of proper preparation of the existing SQL query.

The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'link' Block Attribute. This issue affects all versions up to and including 1.4.4 due to insufficient input sanitization and output escaping.

The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to and including 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping.

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.7.5. This allows authenticated attackers with contributor-level access and above to extract the site's connected Kadence account license key, license owner email, and other sensitive data from the browser console.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to and including 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.3.0 due to missing validation on the 'rule_id' parameter. This allows authenticated attackers with custom-level access and above to modify or delete quiz rules belonging to other teachers.

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.3.13.1. This allows unauthenticated attackers to extract sensitive data such as virtual meeting URLs and location data.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin is vulnerable to Insecure Direct Object Reference in all versions up to 5.0.3. The lack of ownership validation on the order ID key allows authenticated attackers to modify order statuses and add, delete, and modify order notes.

In versions prior to 5.0.0 of vantage6, malicious algorithms can potentially access other algorithms' input and output files. The issue is fixed in version 5.0.0.

In versions prior to 5.0.0 of the vantage6 software, the default user `root` with the password `root` poses a significant security risk. Attackers can easily gain access to the system as many vantage6 servers have this user with admin rights.

In Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0, TLS credentials are written to temporary files that are world-readable on Linux. These files are never deleted, creating a risk of sensitive information exposure.

In Steeltoe projects prior to versions 3.4.0 (CloudFoundryBase), 4.2.0 (JwtBearer), and 4.2.0 (OpenIdConnect), there is an issue with the JWT signing key cache. The `kid` is used as the sole cache key, which can lead to unauthorized token validation in applications with multiple `JwtBearer` schemes pointing to different identity providers.

Steeltoe prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0 have all actuator endpoints defaulting to `EndpointPermissions.Restricted`, which may lead to unauthorized access to sensitive data. Sensitive endpoints such as heap dump, environment, and thread dump are not properly secured.

In versions 10.25.7 and below, the LiquidJS template engine incorrectly propagates the ownPropertyOnly value from the parent context, leading to a silent bypass. As a result, developers may inadvertently expose prototype-chain properties in unsafe renders.

In versions 10.25.7 and below of the LiquidJS template engine, the renderLimit option can be fully bypassed by using an empty {% for %} or {% tablerow %} tag. This allows for unlimited rendering time consumption, potentially leading to DoS attacks.

LiquidJS, a template engine compatible with Shopify/GitHub Pages, has a vulnerability to XSS in versions 10.25.7 and below due to a flaw in the strip_html filter logic. This flaw allows bypassing HTML sanitization, enabling attackers to inject malicious code.

The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. A malicious workspace with a name containing path traversal characters may allow an attacker to write arbitrary files to the user's system.

The unarchive internal module does not perform validation on file paths during archive extraction, relying on external tools, which may lead to unauthorized system access. Specifically, on systems with GNU tar < 1.34, a malicious archive can write files outside the intended extraction directory.

In versions prior to 5.0.0 of the vantage6 software, an attacker who gains access to a user's email account can reset the password and the 2FA token via email, reducing security to a single authentication factor (email access). Version 5.0.0 fixes this issue.