CVE Vulnerability Catalog

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page. The integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain.

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory. This allows unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler plugin before 1.8.17 passes a request-derived URL to its public cache-clearing hook.

A vulnerability has been found in itsourcecode Leave Management System 1.0. An unknown function in /module/leavetype/controller.php allows manipulation of the LEAVTID argument leading to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability exists in Form Tools up to 3.1.1 in the smart_fill function of /global/code/actions.php (AJAX Endpoint component). Manipulation of the url argument allows server-side requests. The exploit is publicly disclosed and can be triggered remotely.

An unrestricted file upload vulnerability exists in Form Tools up to 3.1.1 in the Files::uploadFile function of global/code/actions.php (Ajax Handler component). Manipulation allows remote upload of arbitrary files. The exploit is public and may be used.

A vulnerability exists in Form Tools up to 3.1.1 in the Clients::updateClientSettingsTab function of global/code/Clients.class.php (Client Settings component). Manipulation of the page_titles argument leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely and the exploit is publicly disclosed.

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8 and FIFU Premium before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used. This could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.

The Appointment Booking Plugin – LatePoint for WordPress up to version 5.7.0 is vulnerable to arbitrary shortcode execution. An unauthenticated attacker can plant a malicious shortcode during the booking flow, which gets executed when the Customer Cabinet block renders the stored name.

The WP Popular Posts plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 7.4.2 via the 'context' parameter. Unauthenticated attackers can extract sensitive edit-context fields, including raw title, content, password, meta, status, and guid, from non-public post objects such as wp_block synced patterns that WordPress core refuses to expose.

Hitachi Coding Software Suite up to version 3.3.0 contains a hidden functionality vulnerability that allows an attacker to gain unauthorized access by exploiting hidden accounts or hard-coded credentials.

Hitachi Coding Software Suite up to version 3.3.0 contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations.

Hitachi Coding Software Suite up to version 3.3.0 uses a hard-coded cryptographic key for JWT signing, allowing an attacker to generate unauthorized Bearer tokens and exploit administrative functions.

Hitachi Coding Software Suite up to version 3.3.0 transmits sensitive information in cleartext, allowing an attacker to eavesdrop on authentication credentials and sensitive data in transit.

Hitachi Coding Software Suite up to version 3.3.0 has missing authentication for critical functions. An unauthenticated attacker can invoke critical APIs, potentially leading to unauthorized retrieval or alteration of sensitive information.

Hitachi Coding Software Suite up to version 3.3.0 contains a Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files.

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.