CVE Vulnerability Catalog

sogo_yhn configures SOGo with a parameter that forces requests with the HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, including a privileged user, without providing a password. This issue was fixed in version 5.8.0~ynh9.

The WP Activity Log plugin versions 5.6.6 and earlier contain an SQL Injection vulnerability exploitable by an administrator. An administrator can exploit this to execute unauthorized queries against the database.

Creator LMS plugin version 1.2.19 and earlier contains an 'Other Vulnerability Type' vulnerability exploitable by subscribers, allowing unauthorized actions.

Flexible PDF Coupons plugin version 1.14.11 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.

Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Qi Addons For Elementor plugin version 1.11 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.

Cross Site Scripting (XSS) vulnerability in Premium Addons for Elementor versions up to 4.11.105. Allows an attacker to inject malicious script into the page.

The WPFunnels plugin versions 3.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Astra WordPress Theme versions up to 4.13.12 are vulnerable to Content Injection by a shop manager.

MISP contains a stored cross-site scripting (XSS) vulnerability in the event graph preview feature. The event graph preview image field is accepted and stored without server-side validation, allowing a crafted value to break out of the attribute context and inject arbitrary script.

SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The db_properties function in functions/DatabaseInc.php of the Save Data Handler component allows manipulation of the values argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. The DBQuery function in functions/GetStuListFnc.php of the Student List Search Endpoint component allows manipulation of the LO_sort argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

SQL Injection vulnerability in OS4ED openSIS-Classic up to version 9.3. An unknown function in functions/CustomFieldsFnc.php of the Student Search component allows manipulation of the cust argument, leading to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic versions up to 1.21.0. Allows an attacker to perform unauthorized actions on behalf of a logged-in user.

The Popup by Supsystic plugin versions 1.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Ultimate Maps by Supsystic plugin versions 1.5.5 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The Easy Google Maps plugin versions 1.14.6 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Subscriber Cross Site Scripting (XSS) vulnerability in WP Photo Album Plus versions up to 9.3.02.003. Allows an attacker to inject malicious script into the page.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms versions up to 3.15.3. An attacker can inject malicious script without authentication.

Cross Site Scripting (XSS) vulnerability in Supreme Modules Lite versions up to 2.5.63. An attacker with author privileges can inject malicious script.