CVE Vulnerability Catalog

The Tablesome Table WordPress plugin before version 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions. This allows unauthenticated users to create new published posts and overwrite arbitrary existing posts and pages.

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.3 does not properly sanitize and escape a parameter before reflecting it back in an admin page. This leads to a Reflected Cross-Site Scripting (XSS) that could be used against high-privilege users such as admins.

The Demi plugin for WordPress up to version 0.0.7 stores the HMAC key and restore token in a publicly accessible subdirectory of uploads. An unauthenticated attacker can retrieve the key and forge a request to the demi_restore_step AJAX handler, allowing recursive deletion of arbitrary directories.

The zip-lib library before version 1.1.0 is vulnerable to Directory Traversal via the caching mechanism for path validation during extraction. An attacker can bypass security checks because the isOutsideTargetFolder function only validates the path when the initial symlink is created.

A Broken Access Control vulnerability in the Xendit Payment plugin for WordPress versions up to 7.1.0. An unauthenticated attacker can gain unauthorized access.

A Cross Site Scripting (XSS) vulnerability in the Contest Gallery plugin for WordPress versions up to 30.0.6. An unauthenticated attacker can inject a malicious script.

A Cross Site Scripting (XSS) vulnerability in the Kali Forms plugin for WordPress versions up to 2.4.18. An unauthenticated attacker can inject a malicious script.

A Cross Site Scripting (XSS) vulnerability in the BackWPup plugin for WordPress versions up to 5.7.4. An unauthenticated attacker can inject a malicious script.

SSRF vulnerability in FormCraft up to version 3.9.15. An unauthenticated attacker can make the server send requests to internal network resources.

XSS vulnerability in GiveWP up to version 4.16.3. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in GetGenie up to version 4.4.3. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in Ultimate Addons for Contact Form 7 up to version 3.5.45. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in Message Filter for Contact Form 7 up to version 1.6.3.9. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in Spam protection, AntiSpam, FireWall by CleanTalk up to version 6.82. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in miniorange otp verification up to version 5.5.1. An unauthenticated attacker can inject malicious JavaScript.

SSRF vulnerability in Simple Link Directory Pro up to version 15.0.6. An unauthenticated attacker can make the server send requests to internal network resources.

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.

Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

An issue in Dede CMS version 5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php component.

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component.