CVE Vulnerability Catalog

The uBidAuction 2.0.1 plugin contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the posts/manage module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the auctions/myAuctions/status/loose module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the auctions/myAuctions/status/active module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

A reflected XSS vulnerability exists in the orders/myOrders module of uBidAuction 2.0.1. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject malicious scripts via crafted GET requests that execute in victims' browsers.

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators visit the plugin settings page.

WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.

WordPress Contact Form Builder 1.6.1 contains a reflected XSS vulnerability that allows unauthenticated attackers to inject malicious scripts via the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers.

Reflected XSS in Jetpack plugin 9.1 for WordPress. Unauthenticated attacker can inject malicious script via the post_id parameter in the grunion-form-view.php endpoint.

The Drupal avatar_uploader module version 7.x-1.0-beta8 is vulnerable to Reflected XSS. An unauthenticated attacker can inject malicious scripts via the 'file' parameter in avatar_uploader.pages.inc.

The WordPress plugin amministrazione-aperta 3.7.3 has a local file read vulnerability allowing unauthenticated attackers to read arbitrary files via the open parameter in dispatcher.php due to insufficient input validation.

WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.

WordPress plugin cab-fare-calculator 1.0.3 has a local file inclusion vulnerability. Unauthenticated attackers can read arbitrary files by manipulating the controller parameter in tblight.php with path traversal sequences.

Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting payloads in accommodation type fields. Attackers can inject script tags through the title and excerpt parameters when creating accommodation types, which execute in the browser when visitors access the accommodations page.

Stored XSS in Testimonial Slider and Showcase plugin 2.2.6 for WordPress. Authenticated editors can inject malicious script via the post_title field, which executes for other users.

WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.

WordPress 3dady Real-Time Web Stats plugin version 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript via unsanitized input fields. Attackers can inject JavaScript payloads in the dady_input_text or dady2_input_text fields in the plugin options panel, leading to code execution when the page is viewed.

Moodle LMS 4.0 has a cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to inject malicious scripts via the search parameter in course/search.php. Attackers can execute arbitrary JavaScript in users' browsers and steal session cookies.

OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.

WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL field in the Access Control settings. Attackers can enter JavaScript payloads in the plugin options that are stored in the database and executed when the functionality is triggered, enabling session hijacking or credential theft.