CVE Vulnerability Catalog

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path. This allows the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to OS command injection. The attack may be performed from remote, and the exploit has been publicly disclosed.

A vulnerability was found in aaPanel BaoTa up to version 11.8.0 in the merge_split_file function of the file /www/server/panel/class/files.py in the File Merge Handler component. Manipulation of the split_file_path argument results in command injection, and the attack can be carried out remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Manipulation of the argument Password leads to OS command injection. The attack can be executed remotely, and the exploit has been disclosed to the public.

A vulnerability was found in Frappe HR up to 16.15.0, affecting the get_expense_claims/get_shift_requests/get_attendance_requests functions in hrms/api/__init__.py (Permission Validation component). Manipulation of the employee argument leads to incorrect authorization. The attack can be launched remotely; the vendor confirmed the issue has already been fixed.

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely, and the exploit is now public.

Joomla Extension regularlabs.com Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 is vulnerable to privileged stored XSS via data-rlta-url attributes. The plugin accepts a url option for an item and writes it to a generated data-rlta-url attribute, which the browser code passes to window.open() when the item is activated. Affected versions do not reject browser URL schemes that execute JavaScript.

Joomla Extension regularlabs.com Modules Anywhere versions 1.5.0 - 9.0.5 for Joomla is vulnerable to LFI / SSRF. Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter; Joomla's core Feed module opens the rssurl parameter server-side and accepts local file: URLs as well as network URLs.

A security vulnerability was detected in notionnext-org NotionNext up to 4.10.10, affecting the cleanCache function in pages/api/cache.js (Authentication Guard component). Manipulation of the token argument leads to missing authentication. Versions 4.1.0 - 4.9.5.2 allow unauthenticated exploitation due to missing method check; in versions 4.9.5.7 - 4.10.10 a guard exists but is only enforced when CACHE_REVALIDATION_TOKEN is set, so default deployments remain unprotected. The vendor did not respond to the disclosure.

A weakness was identified in Cesanta Mongoose up to 7.21, affecting the fn function in tutorials/mqtt/mqtt-server/main.c (MQTT Broker component). Manipulation leads to a stack-based buffer overflow. The attack can be launched remotely and the exploit is publicly available. Upgrading to version 7.22 (patch a9df523f76f43a38bd53b4232b9cfd4c16869e71) addresses the issue.

A security flaw was discovered in Netcore NBR200V2 version 1.3.241127.071246. Manipulation of the url argument in the system function of /usr/bin/network_tools within the Tools Ping Handler component results in OS command injection. The attack can be initiated remotely and the exploit has been publicly released.

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24.

Vulnerability in Netcore NBR200V2 1.3.241127.071246 in the eval function of /www/cgi-bin/network_tools in the web management interface. Manipulation of the QUERY_STRING argument leads to OS command injection. Remote attack possible, exploit publicly available.

Vulnerability in Netcore NBR100V2 1.3.240614.030928 in the uci.apply function of /usr/share/rpcd/acl.d/unauthenticated.json in the ACL Handler component. Manipulation of the section argument leads to missing authorization. Remote attack possible, exploit publicly disclosed.

Vulnerability in OctoberCMS up to versions 4.1.19/4.2.25/4.3.4 in the getSourcePathForResize function of modules/system/classes/ResizeImages.php. Manipulation of the realSourcePath argument leads to server-side request forgery (SSRF). Remote attack possible, exploit public. Upgrading to 4.3.5 or 4.4.0 resolves the issue.

Vulnerability in Eyeplus 57.0.0.0308 in an unknown function of the p2pcam HTTP Parser component. Manipulation leads to stack-based buffer overflow. Remote attack possible, exploit publicly disclosed.