CVE Vulnerability Catalog

Remote code execution (RCE) vulnerability in Grav versions 1.7.0 through 2.0.9. FlexDirectory::dynamicDataField() calls call_user_func_array() on attacker-controlled input without restricting dangerous functions like exec or system. An authenticated user with create or update permissions on any Flex directory can execute arbitrary shell commands on the server.

Unauthenticated Cross-Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert versions up to 1.6.5.

The Kwayy HTML Sitemap plugin versions up to 4.0 contain an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unintended actions.

The Persian Woocommerce SMS plugin versions up to 7.2.2 contain an SQL Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can manipulate database queries.

The Visualizer WordPress plugin (versions up to and including 4.0.1) has a blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.

The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.

The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.

The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.

The Complianz plugin versions up to 7.5.0 contain a PHP Object Injection vulnerability exploitable by an administrator. An attacker with admin privileges can inject a malicious PHP object.

The Dokan Pro plugin versions up to 5.0.3 contain an unauthenticated Broken Access Control vulnerability. An attacker can gain unauthorized access to functions or data.

The Dokan Pro plugin versions up to 5.0.2 contain an SQL Injection vulnerability exploitable by a subscriber. An attacker with subscriber privileges can manipulate database queries.

The Dokan Pro plugin version 5.0.2 and earlier allows a subscriber-level PHP object injection. An attacker with subscriber role can submit malicious data that gets deserialized, leading to remote code execution.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the weDevs Dokan Pro plugin allows Reflected XSS. This issue affects Dokan Pro from n/a before 5.0.7.

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio Element Kit for Elementor (lastudio-element-kit) allows Stored XSS. This issue affects versions from n/a through 1.6.2.

The Vino plugin version 1.9 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

The Tonda Core plugin version 2.1.2 and earlier allows a contributor-level Local File Inclusion. A user with contributor role can read arbitrary files from the server.

The Uncanny Automator plugin version 7.3.2 and earlier allows an administrator-level SQL injection. An administrator can execute arbitrary SQL queries against the database.

The Quiz And Survey Master plugin up to version 11.2.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries through specially crafted input.

The MapSVG plugin up to version 8.14.0 contains an SQL injection vulnerability exploitable by a contributor-level user. An attacker can manipulate database queries.