CVE Vulnerability Catalog

The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

Stored XSS vulnerability in shortcodes of the Logo Manager For Enamad plugin for WordPress allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts via the 'title' attribute.

The Bigfishgames Syndicate plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.2. Missing nonce validation in the bigfishgames_syndicate_submenu() function allows unauthenticated attackers to reset and update plugin settings via a forged request, provided they trick an administrator into clicking a link.

The Anomify AI plugin for WordPress up to 0.3.6 is vulnerable to Stored XSS via the 'anomify_api_key' parameter. sanitize_text_field() strips HTML but does not encode double quotes, and the value is echoed into an HTML attribute without esc_attr().

Missing nonce verification in Bottom Bar plugin for WordPress (up to 0.1.7) allows CSRF attacks, enabling unauthenticated attackers to update plugin configuration options.

The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.3. Missing nonce verification in the options() function allows unauthenticated attackers to trick an administrator into clicking a link or visiting a malicious page, resulting in unauthorized changes to plugin settings (e.g., unit preferences) persisted in the database.

The General Options plugin for WordPress up to version 1.1.0 uses sanitize_text_field() for output in the Contact Number field, which does not encode double quotes. This allows administrators to inject JavaScript scripts in settings that execute whenever the settings page is visited.

Stored XSS vulnerability in the 'cvmh-sticky' shortcode of the Sticky plugin for WordPress via the 'readmoretext' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.

The Word 2 Cash plugin for WordPress up to version 0.9.2 is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. Lack of nonce verification, input sanitization, and output escaping allows unauthenticated attackers to forge requests on behalf of an admin and store arbitrary JavaScript payloads.

The Nexa Blocks plugin for WordPress up to version 1.1.1 is vulnerable to Server-Side Request Forgery (SSRF) due to missing URL validation in the import_demo() function. The function accepts a user-supplied URL in the demo_json_file POST parameter and passes it directly to wp_remote_get() without restrictions. Additionally, the AJAX nonce is publicly exposed in frontend HTML, allowing unauthenticated attacks.

The Sentence To SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0. Missing nonce validation on the create_admin_page() function allows unauthenticated attackers to inject malicious scripts and update plugin settings via a forged request, provided they trick a site administrator into clicking a link.

The Oliver POS plugin for WordPress up to version 2.4.2.6 has an authorization bypass vulnerability. The REST API authentication uses loose PHP comparison (==) for the 'OliverAuth' header. On fresh installations where the token option is unset, '0' == false evaluates to true, allowing unauthenticated full API access.

The Diagnosis Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. Missing authorization checks and insufficient input sanitization in the themeFunc() function allow any authenticated user (including subscribers) to save malicious JavaScript to theme files.

In rsync version 3.4.2 and prior, a receiver-side out-of-bounds array read vulnerability exists in recv_files() in receiver.c. A malicious rsync server can crash the rsync client by sending a specially crafted file list, causing a deterministic SIGSEGV.

Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

Microsoft confirmed a Windows vulnerability called 'YellowKey' that bypasses security features. Proof of concept has been published. Users with TPM+PIN are not affected. Microsoft provided temporary mitigations.

Trilium Notes versions 0.102.1 and prior contain a vulnerability to TCC bypass via prompt spoofing in the Electron configuration. A local attacker can run malicious code under the trusted app's identity using the RunAsNode flag to execute arbitrary system commands, leading to misleading macOS permission prompts and access to protected resources.

Trilium Notes versions up to 0.102.1 are vulnerable to Local File Inclusion (LFI). An authenticated attacker can read arbitrary files from the server's filesystem via the uploadModifiedFileToAttachment function.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This is fixed in version 2.28.2.